LPIC-1 Essential System Services and Networking Practice Question
A security administrator needs to allow SSH access from the 10.0.0.0/8 network but deny all other traffic to port 22. The firewall uses iptables with default policy ACCEPT on the INPUT chain. Which set of rules should be added?
⚠ Common exam trap
The trap here is that candidates often forget that iptables processes rules sequentially and that a default ACCEPT policy requires an explicit DROP rule after the ACCEPT rule to deny other traffic, leading them to choose options that either block the allowed source or fail to deny other sources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -j DROP
Iptables processes rules in order, and the first match determines the action. By placing the ACCEPT rule for the 10.0.0.0/8 source first, traffic from that network is allowed. The subsequent DROP rule for all other traffic to port 22 ensures that any packet not matching the first rule is denied, effectively implementing the required allow-from-specific-source, deny-all-others policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
iptables -A INPUT -p tcp --dport 22 -j DROP; iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 22 -j ACCEPT
Why it's wrong here
Order matters; drop rule blocks all SSH before allow.
- ✗
iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 22 -j DROP; iptables -A INPUT -p tcp --dport 22 -j ACCEPT
Why it's wrong here
Drops subnet SSH, allows others.
- ✗
iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 22 -j ACCEPT
Why it's wrong here
Allows subnet but default policy ACCEPT lets others in.
- ✓
iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -j DROP
Why this is correct
Allows subnet first, then drops all other SSH.
Go deeper
Related to this question
About these practice questions
Courseiva writes every LPIC-1 question from scratch — 527 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-1 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-1 exam.