nerdexam
CompTIA

XK0-004 · Question #90

A Linux administrator built a GitLab server. Later that day, a software engineer tried to access the server to upload the repository during the final step of installation. The software engineer…

The correct answer is A. iptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack -. Allowing access to a GitLab web interface requires an iptables rule that accepts inbound TCP traffic on ports 80 and 443 with proper connection tracking so both new and established sessions are permitted.

Security

Question

A Linux administrator built a GitLab server. Later that day, a software engineer tried to access the server to upload the repository during the final step of installation. The software engineer could not access the website. Which of the following firewall rules would allow access to this site?

Options

  • Aiptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack -
  • Biptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack -
  • Ciptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack -
  • Diptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack -

How the community answered

(24 responses)
  • A
    79% (19)
  • B
    13% (3)
  • C
    4% (1)
  • D
    4% (1)

Why each option

Allowing access to a GitLab web interface requires an iptables rule that accepts inbound TCP traffic on ports 80 and 443 with proper connection tracking so both new and established sessions are permitted.

Aiptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack -Correct

The rule 'iptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT' appends an INPUT chain entry that matches TCP packets destined for the standard HTTP and HTTPS ports used by GitLab's web UI. Including '--ctstate NEW,ESTABLISHED' via the conntrack module allows clients to initiate connections and continue them, which is required for full web session functionality. This is the standard stateful iptables pattern for enabling web server access.

Biptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack -

If this choice omits the NEW connection state from conntrack, it would prevent clients from establishing the initial TCP handshake, blocking all new connections to the server.

Ciptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack -

A rule missing conntrack state matching entirely would not properly handle stateful inspection, potentially conflicting with a default DROP policy for untracked packets.

Diptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack -

If this choice specifies an incorrect port number or uses an invalid protocol flag, the rule would not match GitLab's HTTP and HTTPS traffic and access would remain blocked.

Concept tested: iptables stateful rules for web server port access

Source: https://man7.org/linux/man-pages/man8/iptables.8.html

Topics

#iptables#firewall rules#HTTP/HTTPS#conntrack

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full XK0-004 Practice