LFCS ICMP vs TCP filtering Practice Question
You are a Linux administrator for a small company. A developer has deployed a web application on a server with IP 192.168.1.50. The application needs to connect to a database server at 10.0.0.100 on TCP port 3306. Both servers are on the same physical network but different subnets (192.168.1.0/24 and 10.0.0.0/24) connected by a router. The default gateway for the app server is 192.168.1.1, and for the DB server is 10.0.0.1. You have verified that the app server can ping the DB server by IP address successfully. However, the application fails to connect to the database. You have used telnet from the app server to test connectivity on port 3306 and it fails (connection refused). On the DB server, you check that the MySQL service is listening on 0.0.0.0:3306 and that the local firewall (firewalld) allows incoming connections on port 3306. What is the most likely cause of the connection failure?
⚠ Common exam trap
The trap is that successful ping does not guarantee TCP connectivity. ICMP and TCP are handled separately by firewalls; blocking outbound TCP on a specific port will still allow ICMP echo requests and replies. Candidates often overlook host-based outbound firewall rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The app server's firewall is blocking outgoing connections to port 3306.
The app server can ping the DB server, confirming Layer 3 connectivity via ICMP. However, the telnet test fails on port 3306, indicating the TCP SYN packet is not reaching the DB server or the SYN-ACK is not returning. While ping uses ICMP, which may be allowed by the app server's firewall, outbound TCP traffic to port 3306 could be blocked by the local firewall (firewalld) on the app server. This is the most plausible cause because the DB server is configured correctly and the network path is functional for ICMP. Option B is correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The network cable is faulty.
Why it's wrong here
Incorrect. If the network cable were faulty, ping would likely fail as well.
- ✓
The app server's firewall is blocking outgoing connections to port 3306.
Why this is correct
Correct. The app server's firewall may allow ICMP but block outbound TCP to port 3306, explaining why telnet fails while ping succeeds.
- ✗
The router does not have a route to 192.168.1.0/24 from the DB server's subnet, so return packets are dropped.
Why it's wrong here
Incorrect. A missing return route would typically cause ping to fail because ICMP reply packets would also be dropped, but ping succeeds here.
- ✗
The database service is only listening on the loopback interface (127.0.0.1).
Why it's wrong here
Incorrect. The question states MySQL listens on 0.0.0.0:3306, which includes all interfaces.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every LFCS question from scratch — 507 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LFCS practice question is part of Courseiva's free Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LFCS exam.