PCNSE · Question #180
A web server is hosted in the DMZ, and the server is configured to listen for incoming connections only on TCP port 8080. A Security policy rule allowing access from the Trust zone to the DMZ zone nee
The correct answer is D. application: web-browsing; service: (custom with destination TCP port 8080). The 'web-browsing' application uses TCP port 80 as its default port. Using 'application-default' as the service would only allow traffic on port 80, not port 8080. To allow web-browsing on the non-standard port 8080, a custom service object must be created specifying TCP destinat
Question
A web server is hosted in the DMZ, and the server is configured to listen for incoming connections only on TCP port 8080. A Security policy rule allowing access from the Trust zone to the DMZ zone need to be configured to enable we browsing access to the server. Which application and service need to be configured to allow only cleartext web-browsing traffic to thins server on tcp/8080.
Options
- Aapplication: web-browsing; service: application-default
- Bapplication: web-browsing; service: service-https
- Capplication: ssl; service: any
- Dapplication: web-browsing; service: (custom with destination TCP port 8080)
How the community answered
(38 responses)- A5% (2)
- B3% (1)
- C8% (3)
- D84% (32)
Explanation
The 'web-browsing' application uses TCP port 80 as its default port. Using 'application-default' as the service would only allow traffic on port 80, not port 8080. To allow web-browsing on the non-standard port 8080, a custom service object must be created specifying TCP destination port 8080. The combination of application: web-browsing and a custom service for TCP/8080 ensures only cleartext HTTP traffic on that specific port is permitted, providing the most precise and secure rule.
Topics
Community Discussion
No community discussion yet for this question.