117-300 · Question #208
When securing the LDAP directory using TCP Wrappers, choose the correct option to exclude any network not defined in the sample below from having access to the directory. slapd: 10.0.0.0/255.0.0.0…
The correct answer is C. ALL. See the full explanation below for the reasoning.
Question
Options
- AANY
- BACCESS
- CALL
- DNONE
How the community answered
(24 responses)- A8% (2)
- B4% (1)
- C79% (19)
- D8% (2)
Community Discussion
5
Carlos M.Jun 27, 2026C is correct. In TCP Wrappers, ALL is the wildcard that matches every host not already covered by a prior rule, so putting slapd: ALL : DENY as the second line blocks everything that did not match the explicit 10.0.0.0/255.0.0.0 or 127.0.0.1 allowlist above it. ANY is not valid syntax in hosts.deny, and NONE/ACCESS are not real TCP Wrappers tokens.
Devraj B.Jun 28, 2026Solid breakdown, and worth adding for the exam that hosts.allow is evaluated first, so if a host matches there it never reaches hosts.deny at all, which is exactly why the order of your allow rules matters as much as the deny catch-all.
Devraj B.Jun 27, 2026C is right. ALL is the universal wildcard in hosts.deny syntax, catching every host not already permitted.
Thiago A.Jun 26, 2026I almost went with A because I kept thinking "ANY host" reads naturally in English, but ANY is not a valid token in TCP Wrappers, it does not exist in hosts.allow or hosts.deny syntax. The man page for hosts_access(5) is clear: ALL is the universal wildcard that matches every client, so "slapd: ALL : DENY" in /etc/hosts.deny catches anything that did not already match the ALLOW rule above it.
Carlos M.Jun 28, 2026Exactly right, and worth adding that the order-of-evaluation matters too: hosts.allow is checked first, so your ALLOW rule there takes priority and the "slapd: ALL" DENY in hosts.deny is only reached if nothing in hosts.allow matched.