easyMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A network administrator is configuring a firewall…
A network administrator is configuring a firewall to allow only necessary traffic to a web server. The server should be accessible from the internet on port 443 and from a management subnet on port 22. Which firewall rule ensures least privilege?
⚠ Common exam trap
Candidates often choose an option that allows all traffic to the server (like Option C) thinking they can later block unwanted ports, but this violates the default-deny principle and is not considered least privilege in firewall design.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Allow traffic from any to port 443, and from management subnet to port 22; deny all else
It explicitly allows only the required traffic (HTTPS on port 443 from any source, SSH on port 22 from the management subnet) and then denies all other traffic by default. This follows the principle of least privilege by ensuring no unintended services or sources are permitted, which is the core goal of firewall rule design.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Allow traffic from management subnet to port 443 and any to port 22
Why it's wrong here
This incorrectly restricts HTTPS and opens SSH to all.
- ✗
Allow traffic from any source to ports 443 and 22
Why it's wrong here
SSH (22) should not be open to the internet.
- ✗
Allow all traffic to the server, then block specific ports
Why it's wrong here
This violates least privilege by allowing everything first.
- ✓
Allow traffic from any to port 443, and from management subnet to port 22; deny all else
Why this is correct
This restricts SSH to only the management subnet and HTTPS to all, with a default deny.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.