SY0-501 · Question #205
A new firewall has been places into service at an organization. However, a configuration has not been entered on the firewall. Employees on the network segment covered by the new firewall report…
The correct answer is A. The firewall should be configured to prevent user traffic form matching the implicit deny rule. An unconfigured firewall defaults to an implicit deny rule, blocking all network traffic, which necessitates explicit configuration to permit desired user traffic.
Question
A new firewall has been places into service at an organization. However, a configuration has not been entered on the firewall. Employees on the network segment covered by the new firewall report they are unable to access the network. Which of the following steps should be completed to BEST resolve the issue?
Options
- AThe firewall should be configured to prevent user traffic form matching the implicit deny rule.
- BThe firewall should be configured with access lists to allow inbound and outbound traffic.
- CThe firewall should be configured with port security to allow traffic.
- DThe firewall should be configured to include an explicit deny rule.
How the community answered
(40 responses)- A75% (30)
- B8% (3)
- C15% (6)
- D3% (1)
Why each option
An unconfigured firewall defaults to an implicit deny rule, blocking all network traffic, which necessitates explicit configuration to permit desired user traffic.
An unconfigured firewall, by default, applies an implicit "deny all" rule at the end of its rule set, blocking all traffic. To resolve the network access issue, the firewall must be explicitly configured with rules that permit the necessary user traffic, which prevents that traffic from being caught by and denied by the implicit deny rule.
While configuring access lists is the common method to allow traffic through a firewall, option A more accurately describes the fundamental principle being addressed: overriding the firewall's default implicit deny behavior.
Port security is a Layer 2 switch feature designed to restrict devices on a port, not a firewall function for filtering network traffic between segments.
Configuring an explicit deny rule would further restrict network access, exacerbating the problem where users are already unable to access the network due to the firewall's default implicit deny.
Concept tested: Firewall implicit deny rule and initial configuration
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configuration/xe-16-5/sec-data-acl-xe-16-5-book/sec-acl-ip.html#concept_351A2E4BBEA8423485E42C04469DD63C
Topics
Community Discussion
No community discussion yet for this question.