Question 212 of 127
Firewalld Permanent Rule Not Taking Effect: Why Clients Can't Connect
A server's firewall is managed by firewalld. The admin adds a rule to allow HTTPS traffic to the public zone, but clients still cannot connect. What is the most likely cause?
Quick Answer
The answer is that the rule was added with --permanent but firewall-cmd --reload was not run. When you use the --permanent flag in firewalld, the rule is written only to the persistent configuration files on disk, not to the active runtime firewall. Until you execute firewall-cmd --reload, the runtime configuration remains unchanged, so the new HTTPS rule is invisible to the kernel’s netfilter and clients are still blocked. On the Red Hat Certified System Administrator EX200 exam, this is a classic trap: candidates often assume --permanent makes a rule active immediately, but it only ensures survival across reboots. The exam tests your understanding that firewalld has two separate configuration layers—runtime and permanent—and that reloading is required to merge them. Remember the mnemonic: “Permanent is for persistence, reload is for presence.”
⚠ Common exam trap
It's easy for candidates to assume adding a rule with `--permanent` immediately takes effect, forgetting that firewalld requires a reload or the `--runtime-to-permanent` approach to synchronize changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The rule was added with --permanent but firewall-cmd --reload was not run.
When a rule is added with the `--permanent` flag in firewalld, it is written to the configuration files but not applied to the runtime firewall. Until `firewall-cmd --reload` is executed, the runtime configuration remains unchanged, so the new rule allowing HTTPS traffic is not active. Clients cannot connect because the firewall is still blocking HTTPS based on the old runtime rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The rule was added with --permanent but firewall-cmd --reload was not run.
Why this is correct
Permanent rules do not affect runtime until reload.
- ✗
The rule must be added as a rich rule, not a simple service.
Why it's wrong here
Simple service addition is sufficient for standard services.
- ✗
The default zone is not set to public.
Why it's wrong here
If public zone is used, default zone does not matter.
- ✗
firewalld is just a wrapper for iptables, so iptables rules must be cleared.
Why it's wrong here
firewalld manages nftables; iptables rules are separate.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on EX200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Order the steps to configure firewall rules to allow HTTP and HTTPS traffic using firewalld.
medium- ✓ A.1. Add HTTP service: firewall-cmd --permanent --add-service=http 2. Add HTTPS service: firewall-cmd --permanent --add-service=https 3. Reload firewall: firewall-cmd --reload 4. Verify: firewall-cmd --list-services
- B.1. Reload firewall: firewall-cmd --reload 2. Add HTTP service: firewall-cmd --permanent --add-service=http 3. Add HTTPS service: firewall-cmd --permanent --add-service=https 4. Verify: firewall-cmd --list-services
- C.1. Add HTTP service: firewall-cmd --add-service=http (without --permanent) 2. Add HTTPS service: firewall-cmd --add-service=https (without --permanent) 3. Reload firewall: firewall-cmd --reload 4. Verify: firewall-cmd --list-services
- D.1. Add HTTP service: firewall-cmd --permanent --add-service=http 2. Reload firewall: firewall-cmd --reload 3. Add HTTPS service: firewall-cmd --permanent --add-service=https 4. Verify: firewall-cmd --list-services
Why A: Firewalld rules are added with --permanent flag and then reloaded to take effect.
Last reviewed: Jun 11, 2026
This EX200 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.