A network security administrator is configuring traffic filtering rules on a perimeter security appliance connecting an internal server zone () to an isolated database server (). The administrator configures explicit rules permitting TCP port 1433 traffic for database queries. However, administrative management scripts sending UDP status probes on port 1434 from the same subnet are silently dropped without generating an explicit block rule entry in the event log. Which of the following explains why the management script traffic is being blocked?
- The traffic is dropped by the unwritten implicit deny rule evaluated at the end of the access control list when no explicit permit rule matches.Cevap
- BThe firewall automatically denies UDP traffic because transport layer port filtering can only be configured for connection-oriented TCP traffic.
- CAccess control list rules operate exclusively at Layer 3 of the OSI model and cannot evaluate transport layer port numbers such as port 1434.
- DUDP port 1434 traffic is blocked because port numbers above 1024 are reserved strictly for outbound source ports and cannot be destination ports.
Cevap
The traffic is denied because Access Control Lists and firewall rule tables end with an implicit deny all statement, which automatically drops any traffic that fails to match an explicit permit rule.
In firewall and router Access Control List (ACL) implementations, an invisible implicit deny rule exists at the bottom of every rule set. When network traffic (such as UDP port 1434 probes) does not match any of the preceding explicit permit statements, it reaches the end of the rule list and is dropped automatically by the implicit deny.
Adım Adım Çözüm
Anahtar Kavram
ACL Implicit Deny Rule Architecture