Essential System Services and Networking →mediumMultiple ChoiceObjective-mapped

LPIC-1 Essential System Services and Networking Practice Question

Exhibit

Refer to the exhibit.

Chain INPUT (policy DROP)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 ACCEPT     tcp  --  *      *       10.0.0.5             0.0.0.0/0            tcp dpt:22
2      100  5000 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22

Refer to the exhibit. A system administrator notices that remote SSH connections are being blocked from all IP addresses except 10.0.0.5. Which configuration change would allow SSH from any IP?

⚠ Common exam trap

The trap is that candidates may think that because the second rule drops SSH, any new accept rule added later in the chain would override it. However, iptables processes rules in order, so a new accept rule must be placed before the drop rule to allow SSH from any IP.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Add a new rule to accept SSH from any source to the beginning of the chain.

The exhibit shows an iptables INPUT chain with a first rule that accepts SSH from 10.0.0.5 and a second rule that drops all other SSH traffic. Because iptables processes rules in order, the first rule accepts SSH from 10.0.0.5, but all other SSH packets are matched by the second rule and dropped. Adding a new rule to accept SSH from any source at the beginning of the chain ensures that SSH packets from any IP are accepted before reaching the drop rule, allowing connections from any IP.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Add a new rule to accept SSH from any source to the beginning of the chain.
Why this is correct
Correct: Adding an ACCEPT rule for SSH from any source before the DROP rule will allow all SSH traffic, as the packet will be accepted before reaching the DROP rule.
✗
Change the INPUT chain policy to ACCEPT.
Why it's wrong here
Incorrect: The DROP rule (rule 2) still exists and will drop all SSH traffic, overriding the default policy.
✗
Delete the first rule.
Why it's wrong here
Incorrect: Deleting the first rule (ACCEPT from 10.0.0.5) leaves only the DROP rule, which drops all SSH, and the default policy is DROP, so no SSH will be accepted.
✗
Move the second rule to be the first rule.
Why it's wrong here
Incorrect: Placing the DROP rule first would drop all SSH before the ACCEPT rule for 10.0.0.5 is ever evaluated, blocking all SSH.

Go deeper

LPIC-1 Essential System Services and Networking Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question