CISA Practice Question: Arrange the steps to configure a firewall rule in…

Arrange the steps to configure a firewall rule in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Policy, then Specifics, then Action, then Application, then Testing

Firewall rule configuration begins with policy, then specifics, action, application, and testing.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Policy, then Specifics, then Action, then Application, then Testing
Why this is correct
This is the correct order because firewall rule configuration logically begins with defining the security policy, then specifying the details (source, destination, port), choosing the action (allow/deny), applying the rule to an interface/zone, and finally testing to ensure it works as intended.
✗
Specifics, then Policy, then Action, then Application, then Testing
Why it's wrong here
This is incorrect because specifying details (specifics) before defining the overarching security policy can lead to rules that are inconsistent with the organization's security objectives. Policy must be established first to guide the specifics.
✗
Policy, then Specifics, then Application, then Action, then Testing
Why it's wrong here
This is incorrect because applying the rule (application) before choosing the action (allow/deny) is illogical; the action determines what happens to the traffic, and you cannot apply a rule without knowing its action.
✗
Policy, then Action, then Specifics, then Application, then Testing
Why it's wrong here
This is incorrect because selecting the action (allow/deny) before specifying the details (source, destination, port) reverses the logical flow. You need to know the specifics to decide the appropriate action.

Go deeper