Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
CEH Vulnerability Analysis and System Hacking Practice Question
Drag and drop the steps to configure a firewall rule in iptables to block incoming SSH traffic into the correct order.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check current rules, add drop rule for SSH, verify the new rule, save the rules, test connectivity
The correct sequence for configuring an iptables rule to block incoming SSH is to first check the current rules (e.g., with `iptables -L`) to avoid conflicts, then add the drop rule for SSH (e.g., `iptables -A INPUT -p tcp --dport 22 -j DROP`), next verify that the rule is in place (`iptables -L`), then save the rules permanently (e.g., `iptables-save`), and finally test the block by attempting an SSH connection from an external host.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Check current rules, add drop rule for SSH, verify the new rule, save the rules, test connectivity
Why this is correct
This sequence represents the most logical and secure approach for configuring `iptables` rules. Checking current rules (`iptables -L`) is crucial to understand the existing policy and prevent conflicts or unintended rule placement. Adding the specific drop rule for SSH then requires immediate verification (`iptables -L --line-numbers`) to confirm its correct syntax and position within the chain. Saving the rules (`netfilter-persistent save` or `iptables-save`) ensures persistence across reboots, and finally, testing connectivity validates the rule's effectiveness in blocking SSH traffic.
- ✗
Add drop rule for SSH, check current rules, verify the new rule, test connectivity, save the rules
Why it's wrong here
This order is flawed because adding a rule before checking the existing ruleset can introduce conflicts, duplicate entries, or place the new rule in an ineffective position due to a broader, preceding rule. While verification would eventually highlight some issues, a proactive check minimizes configuration errors. Furthermore, testing connectivity before saving means the rule is not persistent, risking loss on reboot, and saving after testing could persist a broken configuration if the test failed.
- ✗
Check current rules, add drop rule for SSH, test connectivity, verify the new rule, save the rules
Why it's wrong here
Testing connectivity immediately after adding a rule but before verifying its application is a critical procedural error. The rule might not have been applied correctly due to syntax issues, incorrect chain specification, or other operational failures, leading to false test results. This premature testing could indicate success when the rule isn't active, or failure for unrelated reasons, making accurate troubleshooting impossible. Verification (`iptables -L`) must always precede functional testing to confirm the rule's presence and parameters.
- ✗
Save the rules, check current rules, add drop rule for SSH, verify the new rule, test connectivity
Why it's wrong here
Initiating the process by saving the rules is fundamentally incorrect and counterproductive. `iptables-save` or `netfilter-persistent save` writes the *current* active ruleset to a persistent configuration file. If no changes have been made yet, this action simply saves the existing, unchanged configuration, effectively overwriting any previous persistent state with the same old state. This negates the purpose of saving and wastes a step, as the desired new rule has not even been added yet.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.