A company firewall engineer has configured a new DMZ to allow public systems to be located away from the internal network. The engineer has three security zones set: Untrust (Internet) - (Remote netwo

This rule permits the entire remote subnet to the entire DMZ subnet, which is far too permissive and violates least privilege since both the source and destination requirements call for single specific hosts.

Rule B (Permit 217.77.88.12 11.12.13.50 RDP 3389) correctly applies least privilege by specifying the exact fixed source IP (217.77.88.12) from the remote network and the exact destination IP of the single RDP server (11.12.13.50) in the DMZ on port 3389. This minimizes attack surface by ensuring only that one host can reach only that one server, precisely matching the stated requirement of a single fixed remote IP accessing a single RDP server. Any broader rule would grant unnecessary access beyond what was requested.

This rule correctly specifies the fixed source IP but targets the entire DMZ subnet rather than the specific RDP server, unnecessarily exposing all DMZ hosts to remote desktop traffic.

This rule correctly targets the specific RDP server but allows the entire remote network subnet as the source, failing to restrict access to the single fixed IP as required.