LPIC-2 Default policy Practice Question
Exhibit
Refer to the exhibit.
# nft list ruleset
table ip filter {
chain input {
type filter hook input priority 0; policy drop;
ct state established,related accept
iifname lo accept
ip saddr 192.168.1.0/24 tcp dport { 22, 80, 443 } accept
ip saddr 192.168.2.0/24 tcp dport 22 accept
}
chain forward {
type filter hook forward priority 0; policy drop;
ip saddr 192.168.1.0/24 oifname eth0 accept
oifname eth0 ip daddr 192.168.1.0/24 accept
}
}A host on 192.168.2.100 tries to SSH to the firewall's IP address (192.168.1.1). The firewall's input chain policy is drop. Will the SSH connection be allowed?
⚠ Common exam trap
The trap is that candidates may assume a rule exists because one of the answer choices mentions it, but the stem does not provide any rule. With only a default drop policy given, the connection is blocked.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No, because the input chain drops all packets that don't match rules.
The stem provides no specific firewall rule. With the input chain policy set to 'drop', all packets not matching any rule are dropped. Since no rule is stated to permit SSH, the connection from 192.168.2.100 to 192.168.1.1 will be blocked. Therefore, the correct answer is 'No' (Option A). Options B and C are incorrect because they either misidentify the traffic type or reference a non‑existent forward rule. Option D is incorrect because the stem does not mention any rule accepting SSH from the 192.168.2.0/24 subnet; such a rule is not provided.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
No, because the input chain drops all packets that don't match rules.
Why this is correct
Correct. The input chain default policy is drop, and no rule is given to allow SSH, so the connection is blocked.
- ✗
No, because SSH to firewall is considered forwarded traffic.
Why it's wrong here
Incorrect. SSH to the firewall's own IP is input traffic, not forwarded traffic. The input chain governs it, not the forward chain.
- ✗
Yes, because the forward chain accepts SSH.
Why it's wrong here
Incorrect. The forward chain handles traffic routed through the firewall, not traffic destined for it. Even if the forward chain accepted SSH, it would not affect this connection.
- ✗
Yes, because there is a rule accepting SSH from 192.168.2.0/24.
Why it's wrong here
Incorrect. The stem does not describe any rule permitting SSH from 192.168.2.0/24. Without such a rule, the default drop policy applies.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every LPIC-2 question from scratch — 507 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.