220-1101 Question 131
Single answerFirewallA small office user reports that a new inventory application on their Windows 11 PC can access the local company server but cannot sync data to the vendor's cloud service over the internet. Web browsing works, and other PCs on the same network can sync successfully. You confirm the PC has the correct IP settings and can resolve the vendor's hostname. Which action should the technician take FIRST to restore application connectivity while following security best practices?
- A
Disable Windows Defender Firewall on the PC to verify whether the firewall is the cause
- B
Create or enable an outbound firewall rule that allows the inventory application or its required port
- C
Open all inbound ports on the workstation so the vendor's cloud service can reach the application
- D
Replace the office router because the firewall on the edge device is blocking only this one PC
Show answer and explanation
Correct answer: B
Explanation
The scenario points to a host-specific firewall issue rather than a network-wide problem. The PC has proper IP configuration, DNS resolution works, web browsing works, and other systems on the same subnet can access the vendor service. That combination strongly suggests the workstation's local firewall is blocking the application's outbound connection. Following the principle of least privilege, the technician should implement the narrowest rule necessary, such as allowing the specific application executable or documented destination port, instead of disabling the firewall or broadly opening ports. This aligns with Microsoft best practices for Windows Defender Firewall, which recommend using specific allow rules and avoiding unnecessary reduction of host-based protections.
- A. Incorrect.
This is not the best first action. Disabling the host firewall may temporarily confirm whether filtering is involved, but it unnecessarily reduces security and is not aligned with best practices when a more targeted approach is available. A technician should prefer reviewing or creating a specific allow rule for the application or required outbound port rather than turning off protection entirely.
- B. Correct.
This is correct. Because the application can reach local resources, DNS works, and other systems on the same network can sync, the issue is likely specific to the affected PC. A host-based firewall rule blocking the application's outbound traffic is a realistic cause. The best first corrective action is to create or enable a targeted outbound allow rule for the executable or required port, preserving security while restoring functionality.
- C. Incorrect.
This is incorrect. The problem described involves the application initiating a connection to a cloud service, which typically requires outbound access from the client, not opening inbound ports on the workstation. Opening all inbound ports would create unnecessary exposure and does not address the likely cause.
- D. Incorrect.
This is incorrect. Since other PCs on the same network can sync to the same cloud service, the edge router is unlikely to be the cause. A router or perimeter firewall problem would typically affect multiple devices or all clients using the same path. Replacing the router would be premature and would not match the troubleshooting evidence.