easyMultiple ChoiceObjective-mapped
CISSP Practice Question: A network administrator notices that users in the…
A network administrator notices that users in the accounting department can access the internet but are unable to access the internal payroll server (10.10.10.50). The firewall rule allows traffic from the accounting subnet (10.10.20.0/24) to the payroll server. What is the most likely issue?
⚠ Common exam trap
The trap here is that candidates often focus on firewall rule direction (inbound vs. outbound) or DNS, overlooking the fundamental requirement for symmetric routing and the fact that the server's default gateway must know how to reach the source subnet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The payroll server's default gateway does not have a route back to 10.10.20.0/24.
The most likely issue is that the payroll server's default gateway does not have a route back to the accounting subnet (10.10.20.0/24). Even if the firewall permits outbound traffic from the accounting subnet to the payroll server, the return traffic from the server must be routed back through the firewall or a router that knows how to reach 10.10.20.0/24. Without a return route, the server's response packets are dropped, causing a one-way communication failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS is not resolving the payroll server's IP address.
Why it's wrong here
If users are accessing the payroll server directly by its IP address, DNS resolution is bypassed entirely. Therefore, an issue with DNS not resolving the server's hostname would not impact connectivity in this specific scenario, as the name-to-IP translation step is not being utilized. This makes the option irrelevant to a problem where direct IP access is failing.
- ✓
The payroll server's default gateway does not have a route back to 10.10.20.0/24.
Why this is correct
For successful two-way communication between devices residing on different subnets, both the source and destination networks must possess valid routes to each other. If the payroll server's default gateway lacks a specific route back to the accounting subnet (10.10.20.0/24), the server's response packets will be dropped, misrouted, or sent to an incorrect destination. This absence of a proper return path prevents the accounting users from receiving data, leading to a perceived connectivity failure.
- ✗
The firewall rule is applied to the outbound interface only.
Why it's wrong here
A firewall rule applied exclusively to the outbound interface would govern traffic originating *from* the server, not necessarily incoming connection requests *to* it. While it might permit the server to initiate connections, it wouldn't prevent the initial connection attempt from the accounting subnet from reaching the server. More importantly, if the issue is that accounting users cannot *reach* the server, an outbound-only rule on the server's firewall would not be the primary cause of the initial connection failure, nor would it block return traffic for an established session if stateful inspection is in place.
- ✗
The accounting subnet is blocked by an implicit deny rule.
Why it's wrong here
Firewall rule sets operate on a hierarchical principle where explicit allow rules take precedence over general implicit deny rules. If an explicit allow rule has been correctly configured to permit traffic from the accounting subnet to the payroll server, it should override any default implicit deny rule at the end of the access control list. Therefore, an implicit deny rule would only block the traffic if the explicit allow rule was absent, misconfigured, or positioned incorrectly in the rule processing order, which contradicts the premise of an existing allow rule.
Visual reference
Go deeper
Related to this question
Learn chapter
Secure Network Architecture and Components
Key term
Firewall rule
A firewall rule is a set of conditions that tells a firewall which network traffic to allow or block based on attributes like source, destination, port, and protocol.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.