6.1. Describe How Firewalls Operate to Filter Traffic. 100-150 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company is migrating from a legacy firewall that has a default-allow policy to a new firewall with a default-deny policy. The administrator needs to ensure that all existing business-critical traffic continues to work. What is the most important initial step?

   • AKeep the default-allow policy and add deny rules for known malicious traffic.
   • BDocument all current traffic flows and create explicit permit rules for each required flow before switching to the default-deny policy.
   • CSwitch to the default-deny policy and then monitor the logs to identify and add rules for blocked traffic.
   • DConfigure the new firewall with the same rule set as the old firewall, including the implicit allow-all rule.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   How do most firewalls evaluate rules when processing traffic?

   • AAll rules simultaneously and apply the most specific match
   • BFrom the bottom to the top of the rule list
   • CIn the order they are listed, from top to bottom
   • DIn random order to balance load
   Reveal Solution Discussion Select an answer first
4. 23expert · medium

   A firewall has a default-deny policy and the following rules in order: 1) Permit TCP/443 from any to 10.0.0.10. 2) Deny TCP/443 from 10.0.0.0/8 to 10.0.0.10. 3) Permit TCP/443 from 10.1.0.0/16 to 10.0.0.10. A packet arrives from source 10.1.2.3 to destination 10.0.0.10 on port 443. What action will the firewall take?

   • ADeny, because the default policy is deny.
   • BDeny, because rule 2 is more specific than rule 1.
   • CPermit, because rule 1 matches first.
   • DPermit, because rule 3 is the most specific match.
   Reveal Solution Discussion Select an answer first
5. 24expert · medium

   A firewall has a default-allow policy. The administrator wants to block all traffic from a specific subnet (192.168.5.0/24) to the internal network, but allow all other traffic. Which rule should be added?

   • ADeny all traffic from 192.168.5.0/24 to the internal network.
   • BAdd a permit rule for all traffic except 192.168.5.0/24.
   • CChange the default policy to default-deny and add permit rules for all other traffic.
   • DAdd a deny rule for 192.168.5.0/24 and a permit rule for all other traffic.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   A firewall rule is configured to block all traffic destined for TCP port 23. Which service is being blocked?

   • ASSH
   • BTelnet
   • CHTTP
   • DDNS
   Reveal Solution Discussion Select an answer first