100-160 Question 55
Select 2A company recently implemented a firewall to protect its internal network. During a routine security review, you discover that the firewall is configured to allow all traffic by default, and only specific ports are blocked. Why is this configuration a security concern, and what is the best practice to address it?
- A
Allowing all traffic by default increases the risk of unauthorized access to the network.
- B
The configuration is secure as long as sensitive ports are blocked.
- C
A best practice is to use a 'deny all by default' rule and explicitly permit necessary traffic.
- D
Firewalls do not need configuration changes as long as antivirus software is installed on all systems.
Show answer and explanation
Correct answers: A, C
Explanation
Firewalls are a critical component of network security, and their configuration determines their effectiveness. Allowing all traffic by default creates significant vulnerabilities, as attackers can exploit open ports or services. A 'deny all by default' approach ensures only explicitly permitted traffic is allowed, minimizing the attack surface and enhancing overall security.
- A. Correct.
Correct: Allowing all traffic by default increases the risk of unauthorized access, as malicious traffic could exploit open ports or vulnerabilities.
- B. Incorrect.
Incorrect: Blocking only sensitive ports is not a sufficient security measure, as attackers can exploit other open ports or services.
- C. Correct.
Correct: 'Deny all by default' ensures any unnecessary or unauthorized traffic is blocked, reducing the attack surface.
- D. Incorrect.
Incorrect: Antivirus software complements firewalls but cannot replace proper firewall configurations.