117-201 · Question #301
Which /etc/hosts.allow entries will permit access to sshd for users from the 192.168.1.0/24 subnet? (Choose TWO correct answers.)
The correct answer is A. sshd : 192.168.1. D. sshd : 192.168.1.0/255.255.255.0. See the full explanation below for the reasoning.
Question
Options
- Asshd : 192.168.1.
- Bsshd : 192.168.1
- Csshd : 192.168.1.0 netmask 255.255.255.0
- Dsshd : 192.168.1.0/255.255.255.0
- Esshd : 192.168.1.0
How the community answered
(21 responses)- A76% (16)
- B5% (1)
- C5% (1)
- E14% (3)
Community Discussion
5
Yusuf A.Jun 23, 2026A and D are the two valid entries here. Option A uses the classic trailing-dot shorthand that tcpwrappers reads as "any address starting with 192.168.1.", and option D uses the CIDR-style slash notation with an explicit subnet mask, which libwrap also accepts. B is a trap because it is missing the final dot so tcpd does not treat it as a prefix match, C uses the "netmask" keyword which is not valid syntax in hosts.allow, and E is just a single host address with no wildcard or mask so it only matches .0 itself.
Toby R.Jun 25, 2026The C point is solid but worth adding that some versions of tcpwrappers will silently ignore that netmask keyword rather than throw an error, which makes it an especially nasty trap on a real exam because you might test it in a lab and get no obvious failure.
Toby R.Jun 18, 2026A and D, watch out for B (missing the dot) and E (bare host address with no mask).
Imani T.Jun 26, 2026I have been running labs on this for weeks and I keep seeing E work fine in practice, the tcpwrappers man page even shows bare network addresses as valid and sshd : 192.168.1.0 reads clean as a subnet match to me. Pair that with A for the prefix shorthand and I am locking in A and E, moving on.
Toby R.Jun 29, 2026Totally get the logic, but E is the catch here. sshd : 192.168.1.0 in hosts.allow matches only that exact host address, not the whole subnet. You need the /24 prefix notation (sshd : 192.168.1.0/24) or the dot-terminated form (sshd : 192.168.1.) for it to work as a subnet match, which is why D is the correct second pick alongside A.