LPIC-2 Advanced Networking Configuration Practice Question
An administrator wants to allow SSH access from the internal network (192.168.1.0/24) only, using nftables. Which rule should be added to the filter table input chain?
⚠ Common exam trap
Test-takers frequently confuse nftables syntax with iptables or think that a comment or semicolon can be used to add conditions, when in fact nftables requires explicit, comma-separated matches within a single rule statement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
iif lo accept; tcp dport 22 ip saddr 192.168.1.0/24 accept
It consists of two separate nftables rules separated by a semicolon. The first rule accepts all loopback traffic, which is necessary to prevent breaking local services. The second rule matches TCP destination port 22 and source IP address 192.168.1.0/24, accepting SSH traffic only from the specified subnet. Any SSH traffic from other sources is implicitly dropped by the default policy of the input chain (typically drop). This syntax is valid in nftables, where semicolons are used to separate multiple rules in a single line.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
tcp dport 22 accept #from 192.168.1.0/24
Why it's wrong here
The comment is not a source condition; the rule accepts SSH from anywhere.
- ✗
tcp dport 22 accept; ip saddr 192.168.1.0/22 accept
Why it's wrong here
First rule accepts all SSH; second rule with wrong netmask does nothing useful.
- ✓
iif lo accept; tcp dport 22 ip saddr 192.168.1.0/24 accept
Why this is correct
Accepts loopback traffic and SSH from the specified subnet.
- ✗
tcp dport 22 ip saddr != 192.168.1.0/24 drop
Why it's wrong here
Drops SSH from non-matching sources but requires a default accept for other traffic, which may not be desired.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 507 original LPIC-2 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.