hardMultiple ChoiceObjective-mapped
CISSP Practice Question: Is configuring a firewall to allow HTTP traffic…
A network engineer is configuring a firewall to allow HTTP traffic from the internet to a web server (10.0.0.10). The firewall has three interfaces: outside (ISP), DMZ (10.0.0.0/24), and inside (192.168.1.0/24). The web server is in the DMZ. Which rule is correct?
⚠ Common exam trap
ISC2 often tests the concept that firewall rules must specify the correct source interface (ingress zone) rather than just the source IP, leading candidates to mistakenly choose rules that match the destination but not the traffic's entry point.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rule: Source interface Outside, Source any, Destination 10.0.0.10, Port 80, Action allow
HTTP traffic from the internet arrives on the outside interface, and the firewall rule must match the source interface (Outside), allow any source IP, and specify the destination IP (10.0.0.10) and port 80. This permits inbound web traffic to the DMZ web server while maintaining security boundaries.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Rule: Source interface Inside, Source any, Destination 10.0.0.10, Port 80, Action allow
Why it's wrong here
This rule specifies the 'Inside' interface as the source, which is incorrect for traffic originating from the internet. Internet traffic always enters the firewall through the 'Outside' interface, which is connected to the untrusted external network. Configuring an 'Inside' source interface would only permit traffic originating from the internal trusted network, not external HTTP requests destined for the DMZ.
- ✓
Rule: Source interface Outside, Source any, Destination 10.0.0.10, Port 80, Action allow
Why this is correct
This rule correctly permits inbound HTTP traffic from the internet to the specified web server. The 'Outside' interface is the proper entry point for external traffic, and 'Source any' allows requests from any public IP address. Directing traffic to destination 10.0.0.10 on Port 80 precisely targets the web server for standard HTTP communication, fulfilling the requirement.
- ✗
Rule: Source interface Outside, Source 192.168.1.0/24, Destination 10.0.0.10, Port 80, Action allow
Why it's wrong here
Specifying 'Source 192.168.1.0/24' is fundamentally incorrect for allowing internet traffic. This IP range is reserved for private networks and would never be the source IP address of a legitimate client on the public internet. Consequently, this rule would prevent all external HTTP access to the web server, as no internet-originated packet would match the defined private source.
- ✗
Rule: Source interface DMZ, Source any, Destination 10.0.0.10, Port 80, Action allow
Why it's wrong here
This rule incorrectly identifies the 'DMZ' interface as the source of incoming internet traffic. While the destination server resides in the DMZ, traffic originating from the internet *enters* the firewall via the 'Outside' interface. A rule with 'Source interface DMZ' would only apply to traffic *originating from* the DMZ network itself, not external requests destined for it.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.