nerdexam
CompTIA

SY0-501 · Question #259

A Chief Security Officer (CSO) has been unsuccessful in attempts to access the website for a accessing the site? Blocked sites: .nonews.com, .rumorhasit.net, *.mars?

The correct answer is C. Rule 3: deny from inside to outside source any destination {blocked sites} service http-https. A Chief Security Officer cannot access a website, and the question asks which firewall rule based on a provided list of blocked sites is preventing access.

Submitted by viktor_hu· Mar 4, 2026Security operations

Question

A Chief Security Officer (CSO) has been unsuccessful in attempts to access the website for a accessing the site? Blocked sites: *.nonews.com, *.rumorhasit.net, *.mars?

Options

  • ARule 1: deny from inside to outside source any destination any service smtp
  • BRule 2: deny from inside to outside source any destination any service ping
  • CRule 3: deny from inside to outside source any destination {blocked sites} service http-https
  • DRule 4: deny from any to any source any destination any service any

How the community answered

(22 responses)
  • A
    5% (1)
  • B
    9% (2)
  • C
    73% (16)
  • D
    14% (3)

Why each option

A Chief Security Officer cannot access a website, and the question asks which firewall rule based on a provided list of blocked sites is preventing access.

ARule 1: deny from inside to outside source any destination any service smtp

This rule denies SMTP traffic, which is used for email communication and not for accessing websites.

BRule 2: deny from inside to outside source any destination any service ping

This rule denies ping traffic, which is used for network connectivity testing (ICMP) and not for accessing websites.

CRule 3: deny from inside to outside source any destination {blocked sites} service http-httpsCorrect

This rule directly prevents access to specific websites by denying HTTP and HTTPS traffic to the defined `{{blocked sites}}` destinations. The CSO's inability to access a website is directly addressed by a rule that specifically targets and blocks web protocols (HTTP-HTTPS) for the listed domains.

DRule 4: deny from any to any source any destination any service any

This rule would deny all traffic to any destination and service, which is an overly broad block and does not specifically target the list of blocked websites as implied by the scenario.

Concept tested: Firewall content filtering and web access control

Source: https://learn.microsoft.com/en-us/azure/firewall/fqdn-filtering

Topics

#firewall rules#content filtering#URL filtering#access control lists

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SY0-501 Practice