As shown in the figure below, the firewall receives a message from PC1 to PC2, which of the following statements is correct?

Question

Options

• AThe packet cannot match the security policies rule1 and rule2, it will match the default policy of the firewall, and the firewall will forward the packet
• BThe default security policy of the firewall is Deny All, and the action is Deny
• CThe message will match the new security policy rule2, and the firewall will forward the message
• DThe message will match the security policy rule 1

• A
  4% (1)
• B
  11% (3)
• C
  82% (23)
• D
  4% (1)

Explanation

Option C is correct because firewall security policies are evaluated top-down, and the traffic from PC1 to PC2 matches the criteria defined in rule2 (such as source/destination zones or IP addresses), which has a permit/allow action - so the firewall forwards the packet without ever reaching the default policy.

Why the distractors are wrong:

• A is wrong because the packet does match a rule (rule2), so it never falls through to the default policy - the default is only reached when no rules match.
• B is misleading: while the default security policy is Deny All, this is irrelevant here because the packet is matched and handled by rule2 before reaching the default.
• D is wrong because rule1's match conditions (likely a different source zone, destination zone, or IP range visible in the figure) do not apply to the PC1→PC2 traffic - rule2's conditions do.

Memory tip: Think of firewall policy matching like a checklist from top to bottom - the first rule whose conditions match wins. If the traffic skips rule1 but hits rule2, rule2 owns it. The default policy is the "catch-all" at the very bottom and only fires when nothing else matched.

No community discussion yet for this question.