Examkin

Question

Difficulty: MediumFirewalls and Access Control Lists (ACLs)

A network administrator is configuring inbound firewall rules on a perimeter security appliance for a web server located in a DMZ with IP address 192.168.50.10/32192.168.50.10/32. Public users must be able to access the secure web application, and system administrators must be able to perform remote command-line administration from an authorized external management subnet (203.0.113.0/24203.0.113.0/24). Which of the following rule configurations are required to fulfill these security requirements? (Select TWO.)

  1. Permit inbound TCP traffic with destination IP 192.168.50.10192.168.50.10 and destination port 443443 from any source IP address.Answer
  2. Permit inbound TCP traffic with destination IP 192.168.50.10192.168.50.10 and destination port 2222 restricted to source IP range 203.0.113.0/24203.0.113.0/24.Answer
  3. C
    Permit inbound UDP traffic with destination IP 192.168.50.10192.168.50.10 and destination port 2222 to minimize shell connection latency.
  4. D
    Append an explicit `permit ip any any` rule at the bottom of the Access Control List to allow return traffic.

Answer

The required configurations are permitting inbound TCP traffic on destination port 443 from any source IP for HTTPS access, and permitting inbound TCP traffic on destination port 22 restricted to the source subnet 203.0.113.0/24 for SSH access.
To securely publish web applications while enabling management access, firewalls must explicitly allow TCP port 443 for public HTTPS traffic and TCP port 22 scoped tightly to administrative IP ranges for SSH traffic.

Step-by-Step Solution

1
Identify protocol and port requirements for public web services.
Secure web services (HTTPS) use TCP on destination port 443 and require open inbound access from public clients.
Public web application delivery requires accessible HTTPS endpoints over TCP port 443.
2
Identify protocol, port, and access restriction requirements for remote management.
Secure administration via SSH uses TCP on destination port 22 and must be restricted to source network 203.0.113.0/24.
Limiting management access to known administrative source subnets follows the principle of least privilege.
3
Evaluate transport layer protocols and ACL default behavior.
UDP is inappropriate for SSH management, and an explicit permit any rule invalidates network security posture.
SSH requires connection-oriented TCP, and firewalls rely on implicit deny logic to block unapproved traffic.

Key Concept

Firewall Rule Protocol Matching and Least Privilege Access Control
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic