This SSCP practice question tests your understanding of default outbound allow. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: default outbound allow. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Refer to the exhibit.
```
netsh advfirewall show currentprofile
Profile : Private
State : On
Inbound connections : Block (default)
Outbound connections: Allow (default)
Firewall Rules:
Rule Name Action Enabled
------------------------------------ -------- -------
File and Printer Sharing (Echo Req) Allow No
Remote Desktop (TCP-In) Allow No
RDP (UDP-In) Block Yes
```
Refer to the exhibit. A security analyst reviews the firewall configuration for a Windows workstation on a private network. What is the MOST significant weakness?
Exhibit
Refer to the exhibit.
```
netsh advfirewall show currentprofile
Profile : Private
State : On
Inbound connections : Block (default)
Outbound connections: Allow (default)
Firewall Rules:
Rule Name Action Enabled
------------------------------------ -------- -------
File and Printer Sharing (Echo Req) Allow No
Remote Desktop (TCP-In) Allow No
RDP (UDP-In) Block Yes
```
A
Inbound connections are set to Block by default
Why wrong: Blocking inbound by default is a security best practice.
B
Default outbound connections are set to Allow, potentially allowing malware to communicate out
Allowing all outbound by default is a security weakness.
C
The rule 'RDP (UDP-In)' is set to Block and enabled, which blocks legitimate RDP traffic
Why wrong: Blocking UDP RDP might be intentional; UDP RDP is less common and can be a vulnerability.
D
The rule 'File and Printer Sharing (Echo Req)' is disabled, preventing network discovery
Why wrong: Disabling this rule is good for security as it reduces attack surface.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Default outbound connections are set to Allow, potentially allowing malware to communicate out
The most significant weakness is that the firewall configuration allows all outbound connections by default. While blocking inbound traffic by default is a secure baseline, permitting unrestricted outbound traffic enables malware or unauthorized software to communicate with external command-and-control servers or exfiltrate data without restrictions. The other options are less impactful: default inbound block (A) is a security best practice; blocking RDP UDP-In traffic (C) is often intentional to prevent vulnerabilities; disabling File and Printer Sharing (D) actually reduces the attack surface. Therefore, the default outbound allow (B) poses the greatest risk.
Key principle: Default outbound allow
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Inbound connections are set to Block by default
Why it's wrong here
Blocking inbound by default is a security best practice.
✓
Default outbound connections are set to Allow, potentially allowing malware to communicate out
Why this is correct
Allowing all outbound by default is a security weakness.
Related concept
Default outbound allow
✗
The rule 'RDP (UDP-In)' is set to Block and enabled, which blocks legitimate RDP traffic
Why it's wrong here
Blocking UDP RDP might be intentional; UDP RDP is less common and can be a vulnerability.
✗
The rule 'File and Printer Sharing (Echo Req)' is disabled, preventing network discovery
Why it's wrong here
Disabling this rule is good for security as it reduces attack surface.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Trap: Candidates often focus on inbound rules or specific blocked ports, overlooking the broader risk of unrestricted outbound connections, which is a common weakness in default firewall configurations.
Detailed technical explanation
How to think about this question
Treat this as a scenario question. Identify the problem, the constraint, and the best action. Then compare each option against those facts.
KKey Concepts to Remember
Default outbound allow
Inbound vs outbound rules
Attack surface reduction
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Default outbound allow
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Default outbound allow Security exam questions test whether you can match controls to threats in context — not just recall definitions.
What to study next
Got this wrong? Here's your next step.
Review default outbound allow, then practise related SSCP questions on the same topic to reinforce the concept.
The correct answer is: Default outbound connections are set to Allow, potentially allowing malware to communicate out — The most significant weakness is that the firewall configuration allows all outbound connections by default. While blocking inbound traffic by default is a secure baseline, permitting unrestricted outbound traffic enables malware or unauthorized software to communicate with external command-and-control servers or exfiltrate data without restrictions. The other options are less impactful: default inbound block (A) is a security best practice; blocking RDP UDP-In traffic (C) is often intentional to prevent vulnerabilities; disabling File and Printer Sharing (D) actually reduces the attack surface. Therefore, the default outbound allow (B) poses the greatest risk.
What should I do if I get this SSCP question wrong?
Review default outbound allow, then practise related SSCP questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Default outbound allow
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.