A single VM runs a web server and a DNS server A separate VM needs to access the DNS server, but is not allowed to access the web server What network control functionality is necessary to enforce…

Question

Options

• Acan use a Palo Alto Networks NGFW for this requirement, but not a port filter firewall.
• Bcan use either a Palo Alto Networks NGFW or a port filler firewall for this requirement.
• Ccan use a port filter firewall for this requirement but not the Palo Alto Networks NGFW.
• Dcan use a specialized VM with advanced threat protection for this requirement

• A
  6% (2)
• B
  3% (1)
• C
  74% (23)
• D
  16% (5)

Explanation

Option C is correct because both services run on the same VM IP address but on different ports (DNS on UDP/TCP 53, web on TCP 80/443) - a port filter firewall operates at Layer 3/4 and can trivially allow traffic to port 53 while blocking ports 80/443 from the separate VM, which is exactly the control needed here.

A Palo Alto NGFW (option A) is not suitable because it uses App-ID for Layer 7 application identification rather than simple port-based filtering; when both services share the same IP, App-ID's application classification can behave unpredictably and may not enforce the intended separation reliably - the tool's strength (deep inspection) becomes a liability for this simple port-differentiation task.

Option B is wrong because it incorrectly claims both solutions work equally well, ignoring the App-ID complication with the NGFW. Option D introduces an irrelevant "advanced threat protection VM," which addresses malware/intrusion detection, not access control between services on the same host.

Memory tip: Think "same IP, different ports = port filter wins." If the services were on different VMs or needed application-layer policy, the NGFW would shine - but when you just need to split traffic by port number on one IP, a simple port filter is the precise, correct tool.

No community discussion yet for this question.