CompTIA
CV0-003 · Question #37
CV0-003 Question #37: Real Exam Question with Answer & Explanation
The correct answer is E: Firewall. Multiple VMs behind NAT share one external IP, and their simultaneous connections triggered the firewall's connection rate-limiting or flood-protection rules, blocking further access.
Troubleshooting
Question
An administrator is testing a new web server from outside of the corporate firewall. The administrator performs a test from a single PC and the web server responds accordingly. The administrator then provisions several virtual machines on a network behind NAT and uses them to perform the same operation on the web server at the same time, but thereafter soon discovers that none of the machines can reach the web server. Which of the following could be responsible?
Options
- AIPS
- BBlacklisting
- CIDS
- DWhitelisting
- EFirewall
Explanation
Multiple VMs behind NAT share one external IP, and their simultaneous connections triggered the firewall's connection rate-limiting or flood-protection rules, blocking further access.
Common mistakes.
- A. An IPS inspects packet content for known attack signatures and can drop malicious traffic, but connection-level rate limiting triggered by a NAT IP flood is primarily a firewall function, not an IPS function.
- B. Blacklisting blocks known-bad IP addresses and would have prevented the single-PC test from succeeding as well, since neither the PC nor the VMs would be pre-listed as malicious.
- C. An IDS passively monitors traffic and generates alerts but does not block connections, so it cannot prevent the VMs from reaching the web server.
- D. Whitelisting would have blocked the VMs entirely from the start rather than only after simultaneous connections were attempted, and would also have blocked the single-PC test if that IP were not on the allowed list.
Concept tested. Firewall connection rate-limiting with NAT source IP
Reference. https://learn.microsoft.com/en-us/azure/firewall/overview
Topics
#firewall#NAT#connection limits#web server access
Community Discussion
No community discussion yet for this question.