hardMultiple ChoiceObjective-mapped
SSCP Practice Question: Refer to the exhibit
Network Topology
Refer to the exhibit. A security analyst reviews these iptables rules and expects SSH access to be blocked, but it is still allowed. What is the MOST likely reason?
⚠ Common exam trap
Many candidates assume iptables evaluates all rules and applies the most restrictive one, but in reality, iptables uses first-match logic, so rule order is critical.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACCEPT rule matches before the DROP rule.
C is correct because iptables processes rules in sequential order, and the first matching rule determines the packet's fate. In this scenario, the ACCEPT rule for SSH (typically matching on port 22) appears before the DROP rule in the chain, so incoming SSH packets match the ACCEPT rule first and are permitted, never reaching the subsequent DROP rule. This is a classic ordering issue where a more specific allow rule precedes a general deny rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DROP rule does not apply to SSH.
Why it's wrong here
The rule specifically targets port 22 (SSH).
- ✗
The DROP rule is misconfigured with wrong source.
Why it's wrong here
Source is 0.0.0.0/0, which matches all.
- ✓
The ACCEPT rule matches before the DROP rule.
Why this is correct
iptables processes rules in order; the first match wins.
- ✗
The default policy allows traffic, overriding the DROP rule.
Why it's wrong here
Default policy only applies if no rule matches.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.