hardMultiple ChoiceObjective-mapped

SSCP Practice Question: Refer to the exhibit

Exhibit

{
  "FirewallPolicies": [
    {
      "Name": "AllowWeb",
      "Source": "0.0.0.0/0",
      "Destination": "10.0.0.0/24",
      "Port": 443,
      "Action": "allow"
    },
    {
      "Name": "BlockSSH",
      "Source": "0.0.0.0/0",
      "Destination": "10.0.0.0/24",
      "Port": 22,
      "Action": "deny"
    }
  ]
}

Refer to the exhibit. What security issue is present in this firewall policy?

⚠ Common exam trap

ISC2 often tests the concept that a firewall policy without an explicit deny all rule at the bottom is inherently insecure, even if all other rules appear correct, because candidates may focus on specific rule content rather than the overall policy structure.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The default deny rule is missing

The exhibit shows a firewall policy with explicit permit rules but no explicit deny all rule at the bottom. Without a default deny rule, any traffic not matching an explicit permit may be implicitly allowed or handled unpredictably depending on the firewall platform, violating the security principle of least privilege. A proper firewall policy must end with an explicit deny all to block all unauthorized traffic.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Web traffic is allowed from any source
Why it's wrong here
This is intended for public access.
✓
The default deny rule is missing
Why this is correct
Without a deny all, any unmatched traffic is allowed.
✗
The firewall is allowing all traffic on port 443
Why it's wrong here
Only port 443 is allowed to the internal subnet.
✗
The destination network is too broad
Why it's wrong here
Broad destination can be acceptable; missing deny is the issue.
✗
SSH is blocked for a specific subnet
Why it's wrong here
Blocking SSH is a security measure.

Visual reference

Go deeper

SSCP Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question