LPIC-2 System Security Practice Question
A Linux server in a DMZ hosts a custom web application that listens on TCP port 8080. The server is also configured with SSH on port 22 for remote administration. Recently, the security team noticed an increase in brute-force attacks against SSH from various external IPs. The server runs Fedora with firewalld as the firewall service. The current firewalld default zone is 'public', and the SSH service is allowed in the 'public' zone. The administrator wants to mitigate the brute-force attacks without blocking legitimate users. Additionally, the administrator wants to ensure that only specific administrative IP addresses can initiate SSH connections, and that SSH connections are rate-limited to prevent flooding. The administrator also needs to keep the web application accessible from any external IP. Which course of action best meets these requirements?
⚠ Common exam trap
Many exam-takers choose Option B (iptables + fail2ban) because they are familiar with those tools, but the question specifically mentions firewalld, and the LPIC-2 exam expects you to know that firewalld can natively handle both source whitelisting and rate limiting without external dependencies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a firewalld rich rule to allow SSH only from specific source IPs, and add a rich rule to limit connection rate for SSH. Keep the web application in the same zone with the appropriate service.
Firewalld rich rules allow granular control: you can specify source IPs for SSH access and apply a connection rate limit (e.g., using 'limit' in the rich rule) to mitigate brute-force attacks without blocking legitimate users. The web application on port 8080 remains accessible from any external IP because the 'public' zone still has the appropriate service allowed, and the rich rules only restrict SSH. This approach avoids changing the default zone or using external tools like fail2ban, keeping the solution within firewalld's native capabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Move SSH to a non-standard port (e.g., 2222) and update the firewalld service definition accordingly.
Why it's wrong here
Obscurity does not prevent brute-force; attackers scan random ports.
- ✗
Use iptables to create a whitelist for SSH, and install fail2ban to rate-limit after 3 failures.
Why it's wrong here
Mixing iptables with firewalld can cause inconsistencies; fail2ban can rate-limit but does not whitelist by default.
- ✗
Change the default zone to 'drop', then add a rich rule to allow SSH only from the administrative network.
Why it's wrong here
Default drop would also block the web application unless it's explicitly added to the same zone or another zone.
- ✓
Add a firewalld rich rule to allow SSH only from specific source IPs, and add a rich rule to limit connection rate for SSH. Keep the web application in the same zone with the appropriate service.
Why this is correct
Rich rules provide granular control; direct rule syntax allows whitelist and rate limit.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every LPIC-2 question from scratch — 507 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.