LPIC-2 System Security Practice Question
Network Topology
Refer to the exhibit. A security audit reveals that the server is not blocking SSH connections from unauthorized networks. What is the most likely cause?
⚠ Common exam trap
It's easy for candidates to confuse the FORWARD chain with the INPUT chain, or mistakenly think that a default DROP policy on INPUT combined with an ESTABLISHED,RELATED rule would somehow allow new SSH connections, when in fact the ESTABLISHED,RELATED rule only permits packets that are part of an already tracked connection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SSH rule does not restrict source IP, so it allows all incoming SSH connections.
The SSH rule in the exhibit uses `--dport 22` without any `-s` or `--source` parameter to restrict the source IP address. This means the rule matches any incoming TCP packet destined for port 22, regardless of its origin network. Without a source IP restriction, the firewall allows SSH connections from all networks, including unauthorized ones, which is the security issue identified by the audit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The FORWARD chain is DROP, blocking all forwarded traffic.
Why it's wrong here
SSH traffic is not forwarded; it is destined for the host itself.
- ✗
The SSH rule uses --dport 22 but missing source IP restriction, allowing all sources.
Why it's wrong here
Correct observation, but this is not the answer choice; see D.
- ✗
The default policy for INPUT is DROP, which should block all, but SSH works due to the ESTABLISHED,RELATED rule.
Why it's wrong here
The ESTABLISHED,RELATED rule allows return traffic, not initial SSH connections.
- ✓
The SSH rule does not restrict source IP, so it allows all incoming SSH connections.
Why this is correct
Without a source IP limitation, the rule permits SSH from any IP address.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every LPIC-2 question from scratch — 507 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.