Objective 4.5: Given a scenario, modify enterprise capabilities to enhance security
Security+ SY0-701 practice question
A company is replacing the rule set on the firewall that separates the internet, its screened subnet, and its internal network. Configure Rule 1 through Rule 4 so that the firewall enforces every requirement below with least privilege. The firewall evaluates rules from top to bottom, applies the first rule that matches, and denies all traffic that matches no rule. It is stateful, so return traffic for an allowed connection is permitted automatically. Use exactly one rule per requirement. The change board requires the allow rules to appear in the same relative order as their requirements; place the deny rule wherever it must go for the policy to work as written.
Interactive question — try it in the free practice test
Explanation
With first-match processing, order matters whenever two rules can match the same packet. The HTTPS rule allows a source of "any", and "any" includes 203.0.113.0/24, so if the deny rule for that range sat below it (for example last, where requirement 4 appears in the list), hostile hosts would match the HTTPS rule first and reach the web server. The deny rule must therefore sit above the HTTPS rule, and because the HTTPS rule is the first allow rule, the deny rule becomes Rule 1. Least privilege means each allow rule names the single host, port, and protocol it needs (not a whole subnet, "any" port, or "any" protocol). No explicit "deny all" rule is needed because the firewall's implicit deny blocks everything else.