Sample question 2 — Network Security
A firewall sits between the internal network and the internet, and also between the internal network and a segment that hosts a payroll server. Users on the internal network should be able to browse the web, but must not reach the payroll server, and established web sessions must still receive their return traffic. Which rule design satisfies these requirements?
- A. A deny rule for the payroll server applied only to outbound traffic, leaving all other traffic unrestricted.
- B. A single allow rule from the internal network to any destination, with the payroll server moved outside the firewall.
- C. An allow rule for all inbound traffic so web servers can respond, with no outbound restrictions.
- D. An explicit allow for outbound web traffic and its established return traffic, followed by an implicit deny-all
Answer: D. Option D is correct. An explicit allow rule permits outbound web traffic and the established return traffic it generates, while a final implicit deny-all rule blocks everything else, including access to the payroll server. Option B is incorrect because an allow rule to any destination would let users reach the payroll server, and moving the server does not address the rule. Option C is incorrect because allowing all inbound traffic exposes the network and still leaves the payroll server reachable. Option A is incorrect because denying only outbound traffic to the payroll server leaves inbound and all other traffic unrestricted.