nerdexam
CompTIA

N10-005 · Question #800

A technician is tasked with adding an ACL to the host-based firewall of a PC. The ACL should allow the Development Server to only connect to the PC's HTTP server on the default port. Given the IP…

The correct answer is A. Source. 192.168.1.100; Source Port: Any; Destination: 192.168.3.3; Destination Port:80; Action: Permit. A host-based firewall ACL filtering inbound traffic must specify the source as the Development Server and the destination port as 80 (HTTP), with the source port set to any because clients use ephemeral high ports. Choice A correctly models this traffic flow.

Network security

Question

A technician is tasked with adding an ACL to the host-based firewall of a PC. The ACL should allow the Development Server to only connect to the PC's HTTP server on the default port. Given the IP addresses below, which of the following ACLs would accomplish this goal? Development Server: 192.168.1.100 PC. 192.168.3.3

Options

  • ASource. 192.168.1.100; Source Port: Any; Destination: 192.168.3.3; Destination Port:80; Action: Permit
  • BSource. 192.168.1.100; Source Port:80; Destination: 192.168.3.3; Destination Port:80; Action: Permit
  • CSource. 192.168.3.3; Source Port:80; Destination: 192.168.1.100; Destination Port: Any; Action: Permit
  • DSource. 192.168.3.3; Source Port:80; Destination: 192.168.1.100; Destination Port:80; Action: Permit
  • ESource. 192.168.1.100; Source Port: Any; Destination: 192.168.3.3; Destination Port: Any; Action: Permit

How the community answered

(33 responses)
  • A
    64% (21)
  • B
    3% (1)
  • C
    21% (7)
  • D
    3% (1)
  • E
    9% (3)

Why each option

A host-based firewall ACL filtering inbound traffic must specify the source as the Development Server and the destination port as 80 (HTTP), with the source port set to any because clients use ephemeral high ports. Choice A correctly models this traffic flow.

ASource. 192.168.1.100; Source Port: Any; Destination: 192.168.3.3; Destination Port:80; Action: PermitCorrect

When the Development Server (192.168.1.100) initiates an HTTP connection to the PC (192.168.3.3), it uses a randomly assigned ephemeral source port and connects to destination port 80. Setting source port to 'Any' correctly accounts for this, while locking destination port to 80 enforces the constraint that only HTTP traffic is permitted.

BSource. 192.168.1.100; Source Port:80; Destination: 192.168.3.3; Destination Port:80; Action: Permit

Setting source port to 80 is incorrect because port 80 is the well-known server port - the client (Development Server) will use a random ephemeral source port, not port 80.

CSource. 192.168.3.3; Source Port:80; Destination: 192.168.1.100; Destination Port: Any; Action: Permit

The source and destination IP addresses are reversed; this rule would permit traffic originating from the PC going to the Development Server, not the other way around.

DSource. 192.168.3.3; Source Port:80; Destination: 192.168.1.100; Destination Port:80; Action: Permit

Both the source/destination IPs are reversed and the source port is incorrectly set to 80, making this rule match the wrong traffic direction entirely.

ESource. 192.168.1.100; Source Port: Any; Destination: 192.168.3.3; Destination Port: Any; Action: Permit

Setting destination port to 'Any' is overly permissive and would allow the Development Server to connect to any port on the PC, violating the requirement to restrict access to only the HTTP port.

Concept tested: Host-based firewall ACL rule creation for HTTP

Source: https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/rules

Topics

#ACL#host-based firewall#access control#port filtering

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full N10-005 Practice