After adding a service to a firewall, which command reloads the firewall to apply changes?

• A. firewall-cmd --reload
• B. firewall-cmd --update
• C. systemctl reload firewalld
• D. firewall-cmd --make-permanent

Answer: (D)

Firewalld works with two layers: runtime rules that are active now and permanent rules saved to disk. When you add a service and save it permanently, you’re updating the stored configuration, and you must reload the daemon for those changes to take effect in the running firewall. The exact command to do that is firewall-cmd --reload, which makes the runtime rules reflect the updated permanent configuration.

If you added the service without --permanent, the change applies immediately and a reload isn’t required. The --permanent option only saves the change for future use; it doesn’t apply it to the current runtime until you reload. The other options don’t perform the targeted reload to apply permanent changes, and systemctl reload firewalld is a broader restart of the daemon rather than the precise, standard method to apply updated firewall rules.