Free Preparation Discussions
MENU
CompTIA SY0-701 Exam - Topic 1 Question 46 Discussion
Topic #: 1
During a security incident, the security operations team identified sustained network traffic from a malicious IP address:
10.1.4.9. A security analyst is creating an inbound firewall rule to block the IP address from accessing the organization's network. Which of the following fulfills this request?
A firewall rule is a set of criteria that determines whether to allow or deny a packet to pass through the firewall. A firewall rule consists of several elements, such as the action, the protocol, the source address, the destination address, and the port number. The syntax of a firewall rule may vary depending on the type and vendor of the firewall, but the basic logic is the same. In this question, the security analyst is creating an inbound firewall rule to block the IP address 10.1.4.9 from accessing the organization's network. This means that the action should be deny, the protocol should be any (or ig for IP), the source address should be 10.1.4.9/32 (which means a single IP address), the destination address should be 0.0.0.0/0 (which means any IP address), and the port number should be any. Therefore, the correct firewall rule is:
access-list inbound deny ig source 10.1.4.9/32 destination 0.0.0.0/0
This rule will match any packet that has the source IP address of 10.1.4.9 and drop it. The other options are incorrect because they either have the wrong action, the wrong source address, or the wrong destination address. For example, option A has the source and destination addresses reversed, which means that it will block any packet that has the destination IP address of 10.1.4.9, which is not the intended goal. Option C has the wrong action, which is permit, which means that it will allow the packet to pass through the firewall, which is also not the intended goal. Option D has the same problem as option A, with the source and destination addresses reversed.
Reference=Firewall Rules -- CompTIA Security+ SY0-401: 1.2,Firewalls -- SY0-601 CompTIA Security+ : 3.3,Firewalls -- CompTIA Security+ SY0-501,Understanding Firewall Rules -- CompTIA Network+ N10-005: 5.5,Configuring Windows Firewall -- CompTIA A+ 220-1102 -- 1.6.
Frederica
2 months agoSharita
2 months agoNoble
2 months agoFrankie
2 months agoEve
2 months agoLindsey
2 months agoMayra
3 months agoDick
3 months agoLynelle
3 months agoKristin
4 months agoChanel
4 months agoJerlene
4 months agoDick
4 months agoBlondell
4 months agoFrancesco
4 months agoTashia
5 months agoElina
5 months agoAdelle
5 months agoMarci
5 months agoJacqueline
5 months agoMignon
5 months agoRodrigo
6 months agoTu
6 months agoMi
6 months agoCristy
6 months agoDevora
21 days agoHaley
26 days agoJacob
1 month agoHyun
1 month agoArminda
1 month ago