CompTIA Server+ SK0-005 Practice Question
While preparing a headless Rocky Linux 9 file server for production, you install the cockpit packages and start the cockpit.socket unit so the team can manage the host through a web interface. The service is confirmed listening on TCP 9090, but attempts to browse to https://filesrv01:9090/ from the administration VLAN are still refused. SELinux is enforcing and the default public firewalld zone is in use. Which single firewalld change will allow secure external access to the Cockpit interface with the least additional exposure?
sudo firewall-cmd --permanent --zone=public --add-port=22/tcp && sudo firewall-cmd --reload
sudo firewall-cmd --permanent --zone=public --add-service=cockpit && sudo firewall-cmd --reload
sudo firewall-cmd --permanent --zone=public --add-port=10000/tcp && sudo firewall-cmd --reload
sudo firewall-cmd --permanent --zone=public --add-service=https && sudo firewall-cmd --reload