nerdexam
CompTIA

SY0-501 · Question #205

A new firewall has been places into service at an organization. However, a configuration has not been entered on the firewall. Employees on the network segment covered by the new firewall report…

The correct answer is A. The firewall should be configured to prevent user traffic form matching the implicit deny rule. An unconfigured firewall defaults to an implicit deny rule, blocking all network traffic, which necessitates explicit configuration to permit desired user traffic.

Submitted by fatima_kr· Mar 4, 2026Security architecture

Question

A new firewall has been places into service at an organization. However, a configuration has not been entered on the firewall. Employees on the network segment covered by the new firewall report they are unable to access the network. Which of the following steps should be completed to BEST resolve the issue?

Options

  • AThe firewall should be configured to prevent user traffic form matching the implicit deny rule.
  • BThe firewall should be configured with access lists to allow inbound and outbound traffic.
  • CThe firewall should be configured with port security to allow traffic.
  • DThe firewall should be configured to include an explicit deny rule.

How the community answered

(40 responses)
  • A
    75% (30)
  • B
    8% (3)
  • C
    15% (6)
  • D
    3% (1)

Why each option

An unconfigured firewall defaults to an implicit deny rule, blocking all network traffic, which necessitates explicit configuration to permit desired user traffic.

AThe firewall should be configured to prevent user traffic form matching the implicit deny rule.Correct

An unconfigured firewall, by default, applies an implicit "deny all" rule at the end of its rule set, blocking all traffic. To resolve the network access issue, the firewall must be explicitly configured with rules that permit the necessary user traffic, which prevents that traffic from being caught by and denied by the implicit deny rule.

BThe firewall should be configured with access lists to allow inbound and outbound traffic.

While configuring access lists is the common method to allow traffic through a firewall, option A more accurately describes the fundamental principle being addressed: overriding the firewall's default implicit deny behavior.

CThe firewall should be configured with port security to allow traffic.

Port security is a Layer 2 switch feature designed to restrict devices on a port, not a firewall function for filtering network traffic between segments.

DThe firewall should be configured to include an explicit deny rule.

Configuring an explicit deny rule would further restrict network access, exacerbating the problem where users are already unable to access the network due to the firewall's default implicit deny.

Concept tested: Firewall implicit deny rule and initial configuration

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configuration/xe-16-5/sec-data-acl-xe-16-5-book/sec-acl-ip.html#concept_351A2E4BBEA8423485E42C04469DD63C

Topics

#implicit deny#firewall rules#ACL#network access control

Community Discussion

No community discussion yet for this question.

Full SY0-501 Practice