A company firewall engineer has configured a new DMZ to allow public systems to be located away from the internal network. The engineer has three security zones set: Untrust (Internet) - (Remote netwo

Permitting the entire /24 source subnet and the entire DMZ subnet is far too broad, allowing any host in the remote network to reach any DMZ host via RDP.

The requirement specifies a 'fixed IP' source (217.77.88.12) connecting to a single 'remote desktop server' in the DMZ (11.12.13.50), so the rule must restrict both endpoints to those exact host addresses. Using host-specific addresses for both source and destination minimizes the attack surface and satisfies the principle of least privilege in firewall policy design.

Although the source is correctly scoped to the fixed host, the destination covers the entire DMZ subnet rather than the specific RDP server, granting unnecessary lateral access.

The destination is correctly scoped to the specific server, but the source permits the entire remote /24 subnet instead of just the designated fixed IP.