220-1201 Practice Question: A company's web server is accessible from the…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The server's default gateway is set to the firewall's LAN IP

  Why it's wrong here

  A server's default gateway, typically configured to the firewall's internal (LAN) IP address, is essential for the server to initiate and send traffic *out* to the internet or other networks. While crucial for the server to access external resources, this setting alone does not dictate how *inbound* connections from the internet reach the server. Without additional firewall rules, external requests will still be blocked, regardless of the server's outbound routing capabilities. Therefore, this configuration is not the reason for the lack of external accessibility.

• ✗

  The firewall's NAT is disabled

  Why it's wrong here

  Network Address Translation (NAT) is fundamental for allowing multiple devices on a private network to share a single public IP address when accessing the internet. If NAT were entirely disabled on the firewall, no internal device, including the web server, would be able to communicate with external networks, nor would external devices be able to initiate connections to private IPs. Since the question implies the server is accessible *internally*, and the problem is specifically about *external* access, a completely disabled NAT would manifest as a broader connectivity failure, not just a lack of inbound web service access. The issue is more granular than a complete NAT failure.

• ✓

  Port forwarding rules are not configured on the firewall

  Why this is correct

  Port forwarding, also known as Destination NAT (DNAT) or inbound firewall rules, is absolutely critical for allowing external internet traffic to reach a specific internal server on a private network. When an external client attempts to connect to the public IP address of the firewall on a specific port (e.g., 80 for HTTP or 443 for HTTPS), the firewall must have a rule explicitly configured to translate that public IP and port to the private IP and port of the internal web server. Without these rules, the firewall, acting as a security barrier, will simply drop unsolicited incoming connection attempts, preventing external users from accessing the web server.

• ✗

  The server has a public IP address assigned

  Why it's wrong here

  If the web server were directly assigned a public IP address, it would inherently be accessible from the internet without the need for port forwarding, assuming no other firewall rules explicitly blocked access. However, the scenario implicitly describes a common network setup where internal servers reside on a private IP address range (e.g., 192.168.x.x) behind a firewall performing NAT. Assigning a public IP directly to an internal server is an uncommon and often less secure configuration, and it contradicts the typical use case where a firewall manages external access to internal private resources.

Go deeper

Related to this question