ISC2 CC Security Operations Practice Question
A security administrator is configuring a firewall to protect an internal network. The administrator needs to allow only HTTP and HTTPS traffic from the internal network to the internet, while blocking all other outbound traffic. Which of the following should the administrator implement?
⚠ Common exam trap
The trap here is assuming that an implicit deny alone is sufficient, when in fact explicit allow rules for the desired traffic must be placed before the deny to permit HTTP and HTTPS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Explicit allow rules for HTTP and HTTPS, followed by an implicit deny
Firewall rule sets are processed in order. To allow only HTTP and HTTPS outbound, explicit allow rules for TCP 80 and 443 must be created first. Then, a final rule (often implicit) denies all other traffic. This ensures that only the desired traffic is permitted and everything else is blocked, meeting the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A deny rule for all traffic except HTTP and HTTPS
Why it's wrong here
A deny rule for all traffic except HTTP and HTTPS is not a standard firewall configuration. Firewalls typically process rules in order, so you need to allow desired traffic first, then deny the rest. Simply having a deny rule that excludes certain ports is not how rule sets are structured; it would need to be a combination of allow and deny rules.
- ✗
An implicit deny rule at the end of the rule set
Why it's wrong here
An implicit deny rule blocks all traffic not explicitly allowed, but it is a default behavior in many firewalls. However, to allow only HTTP and HTTPS, the administrator must first create explicit allow rules for those services. The implicit deny alone would block everything, including the desired traffic, if no allow rules are present.
- ✓
Explicit allow rules for HTTP and HTTPS, followed by an implicit deny
Why this is correct
To allow only HTTP and HTTPS while blocking all other outbound traffic, the administrator must create explicit allow rules for TCP ports 80 and 443 from the internal network to the internet. These rules should be placed before a final implicit deny rule. This ensures that only the desired traffic is permitted and all other traffic is blocked.
- ✗
A stateful inspection rule that allows all outbound traffic
Why it's wrong here
A stateful inspection rule that allows all outbound traffic would permit any traffic from the internal network, not just HTTP and HTTPS. This violates the requirement to block all other outbound traffic. Stateful inspection tracks connections but does not restrict based on application or port unless specific rules are defined.
Go deeper
Related to this question
Learn chapter
Network Security Components and Controls
Key term
Firewall rule
A firewall rule is a set of conditions that tells a firewall which network traffic to allow or block based on attributes like source, destination, port, and protocol.
Key term
TCP
TCP is a connection-oriented transport layer protocol that ensures reliable, ordered, and error-checked delivery of data between applications over IP networks.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.