nerdexam
GIAC

GSLC · Question #570

Sara, a security technician, has received notice that a vendor coming in for a presentation will require access to a server outside of the network. Currently, users are only able to access remote…

The correct answer is D. Write a firewall rule to allow the vendor to have access to the remote site. Writing a targeted firewall rule grants the vendor only the specific outbound access required, following the principle of least privilege without exposing broader network resources.

Security Architecture & Engineering

Question

Sara, a security technician, has received notice that a vendor coming in for a presentation will require access to a server outside of the network. Currently, users are only able to access remote sites through a VPN connection. How could Sara BEST accommodate the vendor?

Options

  • AAllow incoming IPSec traffic into the vendor's IP address.
  • BSet up a VPN account for the vendor, allowing access to the remote site.
  • CTurn off the firewall while the vendor is in the office, allowing access to the remote site.
  • DWrite a firewall rule to allow the vendor to have access to the remote site.

How the community answered

(49 responses)
  • A
    2% (1)
  • B
    6% (3)
  • C
    10% (5)
  • D
    82% (40)

Why each option

Writing a targeted firewall rule grants the vendor only the specific outbound access required, following the principle of least privilege without exposing broader network resources.

AAllow incoming IPSec traffic into the vendor's IP address.

Allowing incoming IPSec traffic addresses inbound tunnels to the internal network, not outbound access from the vendor's device to an external server.

BSet up a VPN account for the vendor, allowing access to the remote site.

Provisioning a full VPN account grants the vendor broader internal network access beyond what is necessary, violating least-privilege principles for a short-term visitor.

CTurn off the firewall while the vendor is in the office, allowing access to the remote site.

Disabling the firewall entirely removes all perimeter security controls, exposing the entire internal network to external threats and is never an acceptable solution.

DWrite a firewall rule to allow the vendor to have access to the remote site.Correct

A firewall rule can be scoped to the vendor's source IP address and the specific destination server, granting the minimum access needed for the presentation. This approach follows the principle of least privilege, avoids provisioning unnecessary credentials, and leaves all other firewall protections intact. It is the most precise and operationally sound solution for a temporary, limited-access requirement.

Concept tested: Firewall rule creation applying least-privilege access control

Source: https://csrc.nist.gov/publications/detail/sp/800-41/rev-1/final

Topics

#firewall rules#vendor access#VPN policy#network access control

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GSLC Practice