CND Network Perimeter Protection Practice Question
A network security engineer needs to configure a Linux-based iptables firewall to drop all incoming TCP packets that have the SYN flag set while the FIN flag is also set, which is a common malformed packet attack vector. Which iptables command should the engineer use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
The iptables rule uses the --tcp-flags match to check the TCP flags. Specifying 'SYN,FIN SYN,FIN' checks that both SYN and FIN flags are set, and matches them to drop the packet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
iptables -A INPUT -p tcp --syn --fin -j DROP
Why it's wrong here
The --syn and --fin shortcuts cannot be combined in this manner to evaluate multiple specific header states simultaneously.
- ✓
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
Why this is correct
This command correctly identifies both the SYN and FIN flags in the TCP header and drops matching packets.
- ✗
iptables -A INPUT -p tcp --flags ALL SYN,FIN -j DROP
Why it's wrong here
Checking against ALL flags with only SYN and FIN set will not accurately isolate the simultaneous presence of just these two flags.
- ✗
iptables -A INPUT -p tcp --match flags --syn-fin -j DROP
Why it's wrong here
There is no built-in '--syn-fin' target or flag match shortcut in standard iptables syntax.
Visual reference
About these practice questions
One of 323 original CND practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.