LPIC-2 System Security Practice Question
An administrator configures iptables on a Linux firewall with the following rules: -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT; -A INPUT -p tcp --dport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT; -A INPUT -j DROP. Users report that SSH connections are being dropped. What is the most likely cause?
⚠ Common exam trap
Candidates often assume that a rule without `-m state` will not match new connections, but in a rule without any state condition, all states are matched. However, in this scenario the SSH rule already has `-m state --state ESTABLISHED,RELATED`, so it truly does not match NEW packets. The LPIC-2 exam expects you to recognize the necessity of explicitly allowing the NEW state for services that require initial connection setup.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SSH rule should have -m state --state NEW to allow new connections.
The most likely cause is that the SSH rule only matches packets that are already part of an established or related connection. New SSH connections start with a SYN packet that is in the NEW state, so they are not matched by the second rule. They fall through to the final DROP rule and are dropped. Adding `-m state --state NEW` (or `-m state --state NEW,ESTABLISHED,RELATED`) to the SSH rule would allow new connections. Option A is incorrect because the default INPUT policy is not relevant when explicit DROP exists; B confuses source and destination ports; D is wrong because reordering does not change the state matching logic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The default INPUT policy is DROP, so the last rule is redundant but harmless.
Why it's wrong here
The default INPUT policy being DROP is not the cause because the explicit DROP rule handles unmatched packets; the redundancy does not affect SSH connectivity.
- ✗
The rule for SSH uses --dport 22, but the source port is randomized; it should use --sport 22.
Why it's wrong here
SSH uses port 22 as the destination port on the server; the source port is randomized. Using --dport is correct, so this is not the cause.
- ✓
The SSH rule should have -m state --state NEW to allow new connections.
Why this is correct
Correct. The SSH rule only matches ESTABLISHED and RELATED packets, so new connection attempts (NEW state) are dropped by the final rule.
- ✗
The established/related rule should come after the SSH rule.
Why it's wrong here
Rule order does not cause the drop because the ESTABLISHED,RELATED rule first handles existing connections, and the SSH rule then matches only ESTABLISHED/RELATED—never NEW—regardless of order.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 507 original LPIC-2 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.