N10-009 Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Allow traffic from the outside interface to the DMZ interface on port 80

  Why this is correct

  This firewall rule is essential for a public-facing web server located within a DMZ. By allowing traffic from the untrusted outside interface to the DMZ interface specifically on port 80, it enables external users to access the web service via HTTP. This configuration ensures the web server is reachable while maintaining the critical security posture of isolating the internal network from direct internet exposure.

• ✗

  Allow traffic from the inside interface to the DMZ interface on port 80

  Why it's wrong here

  Allowing traffic from the inside interface to the DMZ on port 80 would permit internal network users to access the web server. While this might be necessary for administrative tasks or internal testing, it does not address the primary requirement of making the web server accessible to external internet users. This rule alone fails to fulfill the core purpose of hosting a public web server in a DMZ for external client access.

  When this WOULD be correct

  This rule would be correct if the question asked for a rule allowing internal corporate users to access the web server hosted in the DMZ. For example: 'Which firewall rule allows employees on the corporate network to access the company's web server in the DMZ?'

• ✗

  Allow traffic from the outside interface to the inside interface on port 80

  Why it's wrong here

  This rule represents a severe security vulnerability, as it would permit direct inbound HTTP traffic from the untrusted external network straight into the protected internal network. Bypassing the DMZ entirely defeats its fundamental purpose, which is to create a secure buffer zone for public-facing services. Such a configuration would expose sensitive internal resources to direct internet threats, compromising the entire network's integrity.

  When this WOULD be correct

  This option would be correct if the question asked for a rule to allow internal users to access a web server located on the corporate network (inside interface) from the Internet, but that scenario is unrealistic. Alternatively, if the web server were on the inside interface and the goal was to allow external access, this rule would be needed, but that would be a poor security design.

• ✗

  Deny all traffic by default and create no specific rules

  Why it's wrong here

  While a 'deny all' default policy is a crucial security principle for firewalls, it must be complemented by explicit 'allow' rules for legitimate network services. If no specific rules are configured to permit HTTP traffic to the web server in the DMZ, the server would be completely inaccessible from the internet. This renders the public-facing web server useless, as it cannot fulfill its intended function of serving external web requests.

  When this WOULD be correct

  This option would be correct in a question asking for the default security posture of a firewall when no rules are configured, or in a scenario where the goal is to block all traffic and only allow specific traffic after creating explicit allow rules.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question