nerdexam
CompTIA

XK0-005 · Question #354

A network administrator installed a web server on a Linux host and added a firevalid command to open port tcp/80. The web server worked without error until an updated and patch kernel was installed…

The correct answer is D. Use the firevalid command to open tcp/80 both with and without the -permanent switch. This question addresses a common issue where firewall rules added without persistence are lost after a system reboot or kernel update.

Troubleshooting

Question

A network administrator installed a web server on a Linux host and added a firevalid command to open port tcp/80. The web server worked without error until an updated and patch kernel was installed on the system a month later. Now users are unable to access the web server even though the service is running, which of the following would fix the issue?

Options

  • AUse the firevalid command to open the HTTP application service rather than the port.
  • BChange the firevalid zone t private and open port tcp/80.
  • CIssue an additional firevalid command to open up port tcp/443 as well as port tcp/80.
  • DUse the firevalid command to open tcp/80 both with and without the -permanent switch.

How the community answered

(52 responses)
  • A
    10% (5)
  • B
    4% (2)
  • C
    15% (8)
  • D
    71% (37)

Why each option

This question addresses a common issue where firewall rules added without persistence are lost after a system reboot or kernel update.

AUse the firevalid command to open the HTTP application service rather than the port.

While opening the HTTP service is a good practice, it doesn't address the core problem of lost runtime rules after a reboot or update.

BChange the firevalid zone t private and open port tcp/80.

Changing the `firewalld` zone might alter the scope of rules but does not fix the issue of rules not persisting after a reboot or `firewalld` restart.

CIssue an additional firevalid command to open up port tcp/443 as well as port tcp/80.

Opening port `tcp/443` (HTTPS) is for secure web traffic, not HTTP, and is unrelated to the issue of the `tcp/80` rule being lost.

DUse the firevalid command to open tcp/80 both with and without the -permanent switch.Correct

Firewall rules added with `firewalld` using only the runtime configuration are lost upon a reboot or `firewalld` service restart, which can happen during kernel updates. Using the `--permanent` switch saves the rule to the persistent configuration, and then activating it without the switch makes it effective immediately and after future reboots.

Concept tested: Firewalld persistent rules

Source: https://firewalld.org/documentation/man-pages/firewall-cmd.html

Topics

#firewalld#Firewall Rules#Port Opening#Configuration Persistence

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full XK0-005 Practice