easyMultiple ChoiceObjective-mapped

CAS-004 Practice Question: Refer to the exhibit

Exhibit

Firewall Rule Base:
1. permit tcp any any eq 80
2. permit tcp any any eq 443
3. permit udp any any eq 53
4. permit icmp any any

Refer to the exhibit. A security analyst is reviewing the firewall rule set for a corporate network. Which misconfiguration is present?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

No default deny rule present

The rule set lacks an explicit deny rule at the end. Without a default deny, traffic that does not match any rule may be implicitly permitted depending on the firewall platform. Most security best practices require a deny-all trailing rule to ensure only explicitly allowed traffic passes.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
No default deny rule present
Why this is correct
A deny rule should be the last rule to drop all other traffic; otherwise, it may be implicitly allowed.
✗
Overly permissive source IP addresses
Why it's wrong here
The source is 'any' which is permissive, but for a web server that might be intentional; the missing deny is more critical.
✗
Unnecessary allowed ports
Why it's wrong here
Ports 80, 443, and 53 are common for web and DNS; they are likely necessary.
✗
Missing logging on permit rules
Why it's wrong here
Logging is important but not the primary misconfiguration; there is no indication logging is needed.

Visual reference

Go deeper

CAS-004 Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question