Examine these commands, which execute successfully: # firewall-cmd --zone=public --add-service=cockpit --permanent # firewall-cmd --zone=public…

The command firewall-cmd --zone=public --add-service=cockpit --permanent specifically targets the public zone using the --zone=public option. Therefore, the rule for the Cockpit service is applied exclusively to this zone.

The --permanent flag is used in both rule-adding commands, which writes the changes to the configuration files on disk (e.g., /etc/firewalld/zones/public.xml). The firewalld daemon reads these permanent configuration files on startup or when reloaded. This ensures that the configuration persists and is not lost after a system reboot or a restart of the firewalld service. The firewall-cmd --reload command then applies these saved permanent rules to the active runtime configuration.

B: These rules apply to incoming (ingress) traffic by default. Egress traffic is typically allowed. The Cockpit service and port 1313 are two separate rules.

D: The command --add-port=1313/tcp opens or allows traffic on port 1313; it does not block traffic.

E: This command modifies the zone configuration file (in /etc/firewalld/zones/), not the default service definition file located in /usr/lib/firewalld/services/.

---

1. Oracle® Linux 8: Setting Up Networking

Chapter 4

"Using firewalld".

Section 4.3.2

"Working With Predefined Zones": Explains that firewall rules are assigned to zones

and a command with a --zone option applies the rule only to that specified zone. This supports answer A.

Section 4.3.4

"Controlling firewalld Runtime and Permanent Settings": States

"To create a permanent firewall rule

include the --permanent option in the firewall-cmd command... The rule is not applied to the runtime configuration until you either restart the firewalld service or run the firewall-cmd --reload command." This directly supports answer C.

2. firewall-cmd(1) man page:

--zone=zone option description: "Use this zone for the command. ... If a zone is not supplied

the default zone will be used." This confirms that the rule is scoped to the specified zone

supporting answer A.

--permanent option description: "The permanent option can be used to set options permanently. These changes are not effective immediately

only after a reload or restart of firewalld." This confirms the persistence mechanism

supporting answer C.

3. firewalld.zones(5) man page:

DESCRIPTION section: "A zone is described in an XML configuration file. ... The user created and customized zone files are located in /etc/firewalld/zones/." This clarifies that permanent changes modify configuration files

not the service definitions in /usr/lib/firewalld/services/

which refutes option E.