Courseiva
← SSCP
Full test
mediumMultiple ChoiceObjective-mapped

SSCP Default outbound allow Practice Question

Exhibit

Refer to the exhibit.

```
netsh advfirewall show currentprofile

Profile  : Private
State    : On
Inbound connections : Block (default)
Outbound connections: Allow (default)

Firewall Rules:
Rule Name                            Action   Enabled
------------------------------------ -------- -------
File and Printer Sharing (Echo Req)  Allow    No
Remote Desktop (TCP-In)               Allow    No
RDP (UDP-In)                          Block    Yes
```

Refer to the exhibit. A security analyst reviews the firewall configuration for a Windows workstation on a private network. What is the MOST significant weakness?

⚠ Common exam trap

Trap: Candidates often focus on inbound rules or specific blocked ports, overlooking the broader risk of unrestricted outbound connections, which is a common weakness in default firewall configurations.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Default outbound connections are set to Allow, potentially allowing malware to communicate out

The most significant weakness is that the firewall configuration allows all outbound connections by default. While blocking inbound traffic by default is a secure baseline, permitting unrestricted outbound traffic enables malware or unauthorized software to communicate with external command-and-control servers or exfiltrate data without restrictions. The other options are less impactful: default inbound block (A) is a security best practice; blocking RDP UDP-In traffic (C) is often intentional to prevent vulnerabilities; disabling File and Printer Sharing (D) actually reduces the attack surface. Therefore, the default outbound allow (B) poses the greatest risk.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Inbound connections are set to Block by default

    Why it's wrong here

    Blocking inbound by default is a security best practice.

  • ✓

    Default outbound connections are set to Allow, potentially allowing malware to communicate out

    Why this is correct

    Allowing all outbound by default is a security weakness.

  • ✗

    The rule 'RDP (UDP-In)' is set to Block and enabled, which blocks legitimate RDP traffic

    Why it's wrong here

    Blocking UDP RDP might be intentional; UDP RDP is less common and can be a vulnerability.

  • ✗

    The rule 'File and Printer Sharing (Echo Req)' is disabled, preventing network discovery

    Why it's wrong here

    Disabling this rule is good for security as it reduces attack surface.

About these practice questions

One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.