LPIC-2 System Security Practice Question
Which iptables command is necessary to allow incoming SSH connections (port 22) from the subnet 192.168.1.0/24 while dropping all other incoming traffic? Assume the INPUT chain has a default policy of DROP.
⚠ Common exam trap
The trap is that candidates often think they need an explicit DROP rule even when the default policy is DROP. However, the default policy already drops unmatched packets, so only the ACCEPT rule (option C) is necessary. A common mistake is to select both B and C, misunderstanding the word 'necessary' in the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT
It explicitly allows SSH traffic from the specified subnet before the default DROP policy drops everything else. Option B is not necessary because the INPUT chain already has a default policy of DROP, which drops all unmatched packets. Adding an explicit DROP rule at the end is redundant and not required by the question, which asks for the 'necessary' command.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j DROP
Why it's wrong here
This rule drops SSH traffic from the subnet, which is the opposite of what is needed. It would block the allowed SSH connections.
- ✗
iptables -A INPUT -j DROP
Why it's wrong here
This rule is redundant because the default policy on the INPUT chain is already DROP. All packets not matching an earlier ACCEPT rule are dropped by default, so an explicit DROP rule at the end is not necessary.
- ✓
iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT
Why this is correct
This rule correctly allows incoming SSH connections from the subnet 192.168.1.0/24. It matches the source address, TCP protocol, and destination port 22, and jumps to ACCEPT.
- ✗
iptables -A INPUT -j ACCEPT
Why it's wrong here
This rule would accept all incoming traffic, bypassing the default DROP policy. It does not restrict traffic to only SSH from the subnet.
- ✗
iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT
Why it's wrong here
This rule would accept all traffic from the subnet, not just SSH. It is too permissive and does not meet the requirement to allow only SSH.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 507 original LPIC-2 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.