hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A security analyst is reviewing the firewall rules
Network Topology
A security analyst is reviewing the firewall rules. Which of the following best describes the rule set's effect?
⚠ Common exam trap
The CAS-004 exam often tests the distinction between the default policy and explicit rules; candidates mistakenly assume a default ACCEPT policy when the rule set only shows explicit permits, overlooking that the default is DROP unless stated otherwise.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
HTTP is allowed from any source
The rule set includes an explicit permit rule for HTTP traffic from any source, which overrides the default deny policy. Since the default input policy is set to DROP (or DENY), only traffic matching a permit rule is allowed; HTTP is explicitly permitted, making option A correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
HTTP is allowed from any source
Why this is correct
The first rule accepts TCP on port 80 from any source (0.0.0.0/0).
- ✗
Default input policy is ACCEPT
Why it's wrong here
The default policy is DROP, as shown in the first line.
- ✗
ICMP is logged
Why it's wrong here
ICMP is accepted, but logging is done by the LOG rule for all traffic, not specifically for ICMP.
- ✗
SSH is allowed from any source
Why it's wrong here
SSH is only allowed from the 192.168.1.0/24 subnet.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.