LFCS iptables rule order Practice Question
After configuring iptables rules on a Linux server, a junior administrator notices that incoming SSH connections from a specific IP address (192.168.1.100) are being blocked even though there is a rule to allow all traffic from that IP. The current rule set is: 1. -A INPUT -s 192.168.1.100 -j ACCEPT; 2. -A INPUT -p tcp --dport 22 -j DROP. What is the most likely reason for the block?
⚠ Common exam trap
The trap is that the numbered list in the STEM might not reflect the actual order of rules in the iptables chain. Candidates assume the ACCEPT rule is first, but in practice, the DROP rule could have been inserted earlier, causing the block.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The DROP rule for port 22 appears before the ACCEPT rule for the IP.
The rule set as listed would allow SSH from 192.168.1.100 because the ACCEPT rule appears first and matches all traffic from that IP, including SSH. The fact that connections are being blocked indicates that the actual rule order in the iptables chain is different: the DROP rule for port 22 must appear before the ACCEPT rule. Since iptables uses first-match-wins, SSH packets from that IP match the DROP rule first and are dropped. Therefore, the most likely reason is that the DROP rule appears before the ACCEPT rule in the live chain.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The IP address is being matched by a conntrack rule instead.
Why it's wrong here
A conntrack rule is not described; the issue is about rule order.
- ✗
The ACCEPT rule for the IP uses the wrong chain.
Why it's wrong here
The ACCEPT rule is in the INPUT chain, which is correct for incoming traffic.
- ✓
The DROP rule for port 22 appears before the ACCEPT rule for the IP.
Why this is correct
Correct. The block occurs because the DROP rule is evaluated before the ACCEPT rule.
- ✗
The SSH service is listening only on IPv6.
Why it's wrong here
There is no evidence of IPv6-only listening; the issue is with iptables rule order.
Visual reference
Go deeper
Related to this question
About these practice questions
This LFCS question is part of Courseiva's 507-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LFCS practice question is part of Courseiva's free Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LFCS exam.