300-440 · Question #83
Drag and Drop Question Drag and drop the protocols below onto the boxes to complete the policy in this order: TCP, ICMP, then UDP. Answer:
The correct answer is TCP; ICMP; UDP. Protocol Policy Ordering: TCP → ICMP → UDP The question explicitly defines the required order, so this tests your ability to recognize each protocol and place it correctly. Here's the reasoning behind each position: --- Position 1: TCP Why first: TCP is the most prevalent transpo
Question
Exhibit
Answer Area
Drag items
Correct arrangement
- TCP
- ICMP
- UDP
Explanation
Protocol Policy Ordering: TCP → ICMP → UDP
The question explicitly defines the required order, so this tests your ability to recognize each protocol and place it correctly. Here's the reasoning behind each position:
Position 1: TCP
Why first: TCP is the most prevalent transport-layer protocol, carrying the majority of application traffic - HTTP/S, SSH, FTP, SMTP, etc. In network policies (ACLs, firewall rules), TCP entries appear first because:
- It is connection-oriented (uses a 3-way handshake), making it easier to filter statefully
- Most business-critical services depend on TCP, so policy engines prioritize matching it
Position 2: ICMP
Why middle: ICMP is a network-layer control protocol - not a transport protocol. It handles diagnostics (ping) and error reporting (unreachable, TTL exceeded). It sits between TCP and UDP because:
- It operates differently from TCP/UDP (no ports, no sessions)
- Policies typically address application traffic (TCP) before control-plane traffic (ICMP)
- It's more critical to manage than UDP in many security contexts (ICMP can be used in reconnaissance)
Position 3: UDP
Why last: UDP is connectionless - no handshake, no guaranteed delivery. It handles DNS, DHCP, VoIP, and streaming. It appears last because:
- It's harder to track statefully, so policies defer to it
- Its use cases (media, DNS) are generally lower policy priority than TCP applications
Common Mistakes
| Mistake | Why it's wrong |
|---|---|
| Placing ICMP first | ICMP is a control protocol, not the primary application traffic type |
| Swapping TCP and UDP | TCP carries more critical, stateful traffic and belongs first |
| Treating ICMP as a transport protocol | ICMP operates at Layer 3; it has no port numbers like TCP/UDP |
The key insight: this ordering reflects traffic criticality and statefulness - stateful/critical (TCP) → control plane (ICMP) → stateless/ancillary (UDP).
Topics
Community Discussion
No community discussion yet for this question.