LPIC-1 Essential System Services and Networking Practice Question
A small business runs a web application on a Linux server that uses Apache to serve dynamic content via PHP-FPM. The server currently uses the default Apache configuration, but the administrator wants to improve security by limiting access to the server's administrative interface (located at /admin) to only the local network (192.168.1.0/24). The administrative interface is accessed via a separate VirtualHost on port 443. The administrator has created a new VirtualHost configuration file for the admin site. However, after reloading Apache, users from outside the local network can still access the /admin page. The administrator has verified that the VirtualHost is being parsed and that mod_authz_core is enabled. Which of the following actions would most likely resolve the issue?
⚠ Common exam trap
Candidates often confuse network-layer filtering (iptables) with application-layer access control (Apache directives), or mistakenly think that authentication (Require valid-user) can replace IP-based restrictions, when in fact they serve different security purposes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the following inside the <VirtualHost> block for the admin site: <Directory /var/www/admin> Require ip 192.168.1.0/24 </Directory>
The administrator needs to restrict access to the /admin path at the directory level using Apache's mod_authz_core. By placing a <Directory> block inside the VirtualHost that specifies the filesystem path to the admin files and using 'Require ip 192.168.1.0/24', Apache will enforce IP-based access control for that directory. Since the VirtualHost is already being parsed and mod_authz_core is enabled, this is the direct and proper way to limit access to the local network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add the following inside the <VirtualHost> block for the admin site: <Directory /var/www/admin> Require ip 192.168.1.0/24 </Directory>
Why this is correct
This restricts directory access to the local subnet.
- ✗
Add the following to the server's iptables: iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT iptables -A INPUT -p tcp --dport 443 -j DROP
Why it's wrong here
This would block all HTTPS access from outside, not just /admin.
- ✗
Add the following inside the <VirtualHost> block: <Location /admin> Require valid-user AuthType Basic AuthUserFile /etc/httpd/.htpasswd </Location>
Why it's wrong here
This adds authentication but does not restrict IP.
- ✗
Set the DocumentRoot of the default VirtualHost to /var/www/admin.
Why it's wrong here
This would make admin accessible via default VH, not restrict.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 527 original LPIC-1 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-1 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-1 exam.