Overly Permissive Firewall ACL: Risk of Increased Attack Surface
Exhibit
Refer to the exhibit. Access List: ACL-01 10 deny ip host 10.1.1.10 any 20 permit tcp 10.1.1.0 0.0.0.255 any eq 443 30 permit udp 10.1.1.0 0.0.0.255 any eq 53 40 deny ip any any
Refer to the exhibit. A risk practitioner is reviewing the access control list for a critical server. The ACL is applied inbound on the interface connecting to the internet. Which of the following is the MOST significant risk?
Quick Answer
The answer is that permitting all HTTPS and DNS traffic from any internet source to a critical server is the most significant risk because it directly increases the attack surface. By allowing broad inbound access on TCP/443 and UDP/53 without restricting source IPs, the firewall ACL exposes the server to exploitation of vulnerabilities in web server software and DNS services, such as SQL injection, cross-site scripting, or DNS tunneling. On the CRISC exam, this scenario tests your ability to identify how overly permissive ACLs expand the attack surface, a core concept in risk identification and control design. A common trap is focusing on the protocol itself as safe, rather than recognizing that unrestricted access to common services invites attack. Remember the memory tip: “Permit all, risk fall”—any ACL that says “permit any” for high-risk ports like 443 or 53 is a red flag for increased attack surface.
⚠ Common exam trap
The trap here is that candidates often focus on missing logging (option B) or missing HTTP (option C) as the most critical issue, but the real risk is the overly permissive ACL that allows all HTTPS and DNS traffic from any source, which dramatically increases the attack surface and is a classic misconfiguration in ACL design.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL permits all HTTPS and DNS traffic from the subnet, increasing attack surface
Permitting all HTTPS (TCP/443) and DNS (UDP/53) traffic from any source on the internet to the critical server unnecessarily exposes the server to potential exploitation of vulnerabilities in the web server software (e.g., Apache, Nginx) and DNS resolver services. This broad permit statement increases the attack surface significantly, as HTTPS and DNS are common vectors for attacks such as SQL injection, cross-site scripting, and DNS amplification or tunneling. The risk is heightened because the ACL is applied inbound on the internet-facing interface, meaning all external traffic matching these protocols is allowed without restriction, bypassing any stateful inspection or application-layer filtering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The ACL permits all HTTPS and DNS traffic from the subnet, increasing attack surface
Why this is correct
Broad permits may allow unauthorized traffic.
- ✗
The ACL has no logging enabled
Why it's wrong here
Lack of logging is a concern but less critical than broad permits.
- ✗
The ACL is missing a permit statement for HTTP
Why it's wrong here
HTTP is not required; HTTPS is more secure.
- ✗
The ACL blocks all traffic from the internet
Why it's wrong here
The ACL permits specific traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CRISC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. An organization uses this firewall access list. What is the MOST significant risk associated with this configuration?
medium- A.The final rule denies all traffic
- B.HTTPS traffic is permitted to any destination
- C.SSH access is only allowed from internal network
- ✓ D.HTTP traffic is permitted from any source to any destination
Why D: Permitting HTTP traffic (TCP port 80) from any source to any destination exposes the organization to significant risk, including data interception, man-in-the-middle attacks, and exploitation of web application vulnerabilities. HTTP transmits data in cleartext, making it trivial for attackers on the same network segment to capture credentials, session tokens, or sensitive information. This broad rule violates the principle of least privilege and is a common misconfiguration that leads to data breaches.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.