Risk Response and Mitigation →mediumMultiple ChoiceObjective-mapped

CRISC Risk Response and Mitigation Practice Question

Exhibit

Refer to the exhibit.

Exhibit: Firewall rule configuration

```
access-list 100 permit tcp any any eq 80
access-list 100 permit tcp any any eq 443
access-list 100 permit tcp 10.0.0.0 0.255.255.255 any eq 22
access-list 100 deny ip any any
```

Refer to the exhibit. An organization uses this firewall access list. What is the MOST significant risk associated with this configuration?

⚠ Common exam trap

The trap here is that candidates often focus on the 'deny all' rule as a risk (thinking it might block legitimate traffic) or overlook the severity of allowing unencrypted HTTP, mistakenly assuming HTTPS and HTTP are equivalent in risk level.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

HTTP traffic is permitted from any source to any destination

Permitting HTTP traffic (TCP port 80) from any source to any destination exposes the organization to significant risk, including data interception, man-in-the-middle attacks, and exploitation of web application vulnerabilities. HTTP transmits data in cleartext, making it trivial for attackers on the same network segment to capture credentials, session tokens, or sensitive information. This broad rule violates the principle of least privilege and is a common misconfiguration that leads to data breaches.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The final rule denies all traffic
Why it's wrong here
This is a standard security practice.
✗
HTTPS traffic is permitted to any destination
Why it's wrong here
HTTPS is necessary and encrypted.
✗
SSH access is only allowed from internal network
Why it's wrong here
This is a good control.
✓
HTTP traffic is permitted from any source to any destination
Why this is correct
Unrestricted HTTP exposure is risky.

Visual reference

Go deeper

CRISC Risk Response and Mitigation Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question