CAS-003 · Question #247
Given the following output from a local PC: Which of the following ACLs on a stateful host-based firewall would allow the PC to serve an intranet website?
The correct answer is B. Allow 172.30.0.28:80 -> 172.30.0.0/16. Tests knowledge of host-based firewall ACL rules for restricting a web server's outbound traffic to the intranet network only.
Question
Given the following output from a local PC:
Which of the following ACLs on a stateful host-based firewall would allow the PC to serve an intranet website?
Options
- AAllow 172.30.0.28:80 -> ANY
- BAllow 172.30.0.28:80 -> 172.30.0.0/16
- CAllow 172.30.0.28:80 -> 172.30.0.28:443
- DAllow 172.30.0.28:80 -> 172.30.0.28:53
How the community answered
(38 responses)- A3% (1)
- B79% (30)
- C13% (5)
- D5% (2)
Why each option
Tests knowledge of host-based firewall ACL rules for restricting a web server's outbound traffic to the intranet network only.
ANY as the destination is overly permissive for an intranet-only website, allowing the server to respond to clients on any network including external ones.
The PC at 172.30.0.28 serves a website on port 80, and the stateful firewall must allow response traffic from that port to reach intranet clients. Restricting the destination to 172.30.0.0/16 correctly scopes outbound web traffic to the local intranet subnet, satisfying the intranet-only requirement while preventing exposure to external networks.
This routes traffic from port 80 back to the same host on port 443, which is a loopback to HTTPS on the local machine rather than serving web content to intranet clients.
This routes traffic from port 80 back to the same host on port 53 (DNS), which is nonsensical for delivering web content to intranet clients.
Concept tested: Host-based firewall ACL for intranet web server
Source: https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-port-rule
Topics
Community Discussion
No community discussion yet for this question.