6.1. Describe How Firewalls Operate to Filter Traffic. 100-150 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security architect is designing a firewall policy for a new DMZ. The DMZ hosts a public web server and an email server. The architect wants to minimize the attack surface while ensuring the servers function. Which policy approach is most appropriate?

   • ADefault-allow with a single deny rule for inbound traffic to the DMZ subnet.
   • BDefault-allow with explicit denies for all ports except 80, 443, and 25.
   • CDefault-deny with a single allow rule for all traffic to the DMZ subnet.
   • DDefault-deny with explicit allows for inbound HTTP/HTTPS to the web server and SMTP to the email server, plus outbound responses.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the key difference between a default-deny and a default-allow firewall policy?

   • ADefault-deny requires more processing power than default-allow
   • BDefault-deny blocks all traffic unless explicitly allowed; default-allow permits all traffic unless explicitly blocked
   • CDefault-deny is used only for inbound traffic; default-allow is used only for outbound traffic
   • DDefault-deny applies to TCP traffic; default-allow applies to UDP traffic
   Reveal Solution Discussion Select an answer first
4. 3application · easy

   A firewall rule is written as: 'Allow TCP from 192.168.1.0/24 to any on port 25.' Which type of traffic does this rule permit?

   • ASecure web browsing from the local subnet to any destination.
   • BFile transfer from the local subnet to any destination using FTP.
   • CRemote administration from the local subnet to any destination using SSH.
   • DEmail transmission from the local subnet to any destination using SMTP.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A firewall has these rules in order: 1) deny TCP from any to any port 22, 2) allow TCP from 10.0.0.0/8 to any port 22, 3) allow TCP from any to any port 22. A packet arrives from source 10.1.2.3 destined to port 22. What will the firewall do?

   • ADeny the packet because rule 1 matches first and the firewall stops at the first match.
   • BAllow the packet because rule 3 is the last rule and permits all TCP to port 22.
   • CAllow the packet because rule 2 is more specific than rule 1 and overrides it.
   • DDeny the packet only if no later rule allows it; otherwise allow it.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A firewall administrator is troubleshooting why a specific host cannot reach a service. The firewall rules are: 1) deny TCP from any to any port 3389, 2) allow TCP from 10.0.0.0/8 to any port 3389, 3) allow TCP from any to any port 3389. The host at 10.1.1.5 cannot connect to a server on port 3389. What is the most likely cause?

   • AThe firewall is using default-allow, so the deny rule is ignored.
   • BRule 3 is placed too low and cannot override rule 1.
   • CRule 1 matches the host's traffic before rule 2, so the connection is denied.
   • DRule 2 is too broad and blocks the host because it is outside the 10.0.0.0/8 range.
   Reveal Solution Discussion Select an answer first