A company firewall engineer has configured a new DMZ to allow public systems to be located away from the internal network. The engineer has three security zones set: Untrust (Internet) - (Remote…

This rule permits the entire remote subnet to the entire DMZ subnet, which is far too permissive and violates least-privilege principles by exposing all DMZ hosts to all remote hosts.

Rule B uses the exact source host 217.77.88.12 and the exact destination host 11.12.13.50, matching the requirement of a fixed IP connecting to a specific RDP server. This is the most restrictive rule possible for this scenario, limiting exposure to only the two hosts involved. Following least-privilege in firewall policy minimizes attack surface and reduces the risk of lateral movement if the source or DMZ segment is compromised.

Although the source is correctly restricted to the single host 217.77.88.12, the destination covers the entire DMZ subnet rather than the specific RDP server, unnecessarily exposing all DMZ systems.

The destination server is correctly specified as 11.12.13.50, but the source is broadened to the entire remote subnet, allowing any host in 217.77.88.0/24 to initiate RDP connections instead of only the fixed IP.