LPIC-2 System Security Practice Question
Network Topology
Refer to the exhibit. An administrator has applied these iptables rules. Users can still SSH into the server from any IP address, which is unexpected because the administrator intended to restrict SSH to only a specific subnet. What is the most likely reason the restriction is not working?
⚠ Common exam trap
Many exam-takers assume the DROP rule will block all traffic except the intended subnet, but they overlook that the ACCEPT rule without a source IP matches everything first, making the DROP rule unreachable for SSH packets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SSH rule does not specify a source IP, so it accepts connections from any IP.
The SSH ACCEPT rule does not include a source IP specification, so by default iptables matches any source address. The administrator intended to restrict SSH to a specific subnet, but without a `-s` parameter, the rule accepts all incoming SSH connections regardless of origin. The DROP rule for other subnets is never reached because the ACCEPT rule matches first for all SSH traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The SSH rule does not specify a source IP, so it accepts connections from any IP.
Why this is correct
Without a -s option, the rule matches all source IPs, leading to unrestricted SSH access.
- ✗
The default policy is ACCEPT, so the DROP rule is ignored.
Why it's wrong here
The DROP rule is explicit and overrides the default policy for matched packets.
- ✗
The conntrack module is not loaded, so the state matching fails.
Why it's wrong here
If conntrack were not loaded, the rules would fail entirely; SSH would not work at all.
- ✗
The rules are in the wrong order; the DROP rule should be before the SSH rule.
Why it's wrong here
Order is correct: established/related first, then new SSH, then drop.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every LPIC-2 question from scratch — 507 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.