A technician wants to implement a firewall ACL to block external access to the company's SSH server. Which of the following should the technician implement to configure the firewall so it will inform

LOG records packet information to the system log but takes no action on the packet itself - it does not block or notify the source and is typically combined with another target.

The REJECT target in iptables sends an ICMP 'port unreachable' or TCP RST packet back to the originating host, explicitly informing it that the connection was denied. This active notification is the key distinction from DROP, which silently discards packets with no response. Configuring REJECT on port 22 (SSH) will both block access and communicate the rejection to the external source.

CONNTRACK (or connection tracking) is a stateful inspection mechanism that tracks connection states, not a terminal target that blocks or notifies traffic sources.

DROP silently discards packets without sending any response to the source, so the sender receives no notification that the traffic was blocked - the opposite of what is required.