Which of the following is considered to be the most secure default firewall policy, yet usually causes the most work from an administrative perspective?

Fatima Z.Jan 5, 2026

The answer is B, block everything first and only open doors you need, and here is why that image sticks: picture a bouncer who says NO to every single person by default, and only lets someone in if their name is on the approved list. That is your default-deny policy, and it is the gold standard for firewall security because any traffic not explicitly permitted is automatically stopped cold. The reason it causes so much admin headache is that someone has to build and maintain that approved list from scratch, hunting down every legitimate service, port, and IP that the business actually needs and writing a rule for each one. Option D is the risky flip side, allow everything and try to catch the bad stuff, which is like leaving the club doors wide open and hoping your bouncers spot every troublemaker. Remember it as DENY FIRST, DOCUMENT ALWAYS, because the pain is in the paperwork, not the principle.

Brenda K.Jun 9, 2026

Quick win here, do not overthink it, answer is B and bank the time. Blocking all traffic by default and then carving out only what you need is the principle of least privilege applied to network access. It is the most secure stance because anything you did not explicitly permit is denied, so unknown or malicious traffic has no path through. The administrative burden is exactly why it feels painful, you have to inventory every legitimate flow, build the rules one by one, and revisit them constantly as the environment changes. D is the trap answer because it sounds manageable until you realize you can never enumerate all the bad stuff, you can only reliably define the good.

Viktor S.Jun 14, 2026

B is the right call, and if you have even a passing familiarity with firewall policy you should be able to reason your way there without memorizing it. The logic is simple: deny-all plus explicit allow means every service someone needs gets a ticket cut for it, which is exactly why admins hate it but auditors love it. Here is what I want you to think through though, because this is where people trip up on the job: if you inherit a firewall already running deny-all, and a new business app needs outbound access to an external API on a non-standard port, what is your process for figuring out the minimal set of rules to add without accidentally opening more than you intended?

Nina C.Dec 13, 2025

D is tempting because "allow all, block suspects" sounds like less day-to-day hassle, but that approach means threats you have not identified yet get a free pass. B is the answer, because a default-deny policy means every single legitimate connection has to be explicitly permitted, which is a ton of upfront and ongoing work but gives you the tightest control.

Mateus R.Jun 16, 2026

I almost picked D thinking that a bouncer who lets everyone in and only kicks out troublemakers would be easier to manage, but then I remembered my buddy who runs a private club where nobody gets in unless their name is on the list, and yeah, he spends half his life updating that list, which is exactly what option B describes, the default-deny policy, most secure because nothing slips through by accident, most painful because you have to hand-approve every single legitimate connection yourself.

Bao N.Jun 5, 2026

B is the right call, blocking everything by default and only opening what you actually need is the principle of least privilege applied to traffic, and it is the gold standard for firewall posture. The admin headache comes from the fact that every new service or app requires a deliberate rule, so you are constantly fielding tickets instead of just letting things flow through.

Samuel O.Dec 27, 2025

B, deny all then permit by exception. My practice lab broke three apps before I traced it back to that policy, which is exactly why it appeared on my exam and why I knew it cold.

Quincy P.Dec 22, 2025

Going with C on this one, because tying the firewall directly into the IDS means every rule change or alert response has to be reviewed, coordinated, and documented across two systems, and that overhead is exactly what makes it the heaviest lift for the admin team while also giving you the tightest, most context-aware perimeter control.