220-1102 Question 170
Single answerLocal OS firewall settingsA small office uses Windows 11 PCs, and a shared accounting application on one workstation needs to accept incoming connections from three other PCs on the same private LAN. The application worked before a recent security hardening change, but now the other users cannot connect. You verify that the application is running, the workstation has the correct IP address, and no network outage exists. Company policy says you should restore functionality while exposing the least amount of unnecessary network access. What is the BEST action to take on the workstation hosting the application?
- A
Disable Microsoft Defender Firewall for the Private network profile so the accounting application can receive inbound traffic
- B
Create an inbound Windows Defender Firewall rule that allows only the accounting application's required traffic on the Private profile
- C
Change the network location from Private to Public so Windows applies stricter filtering consistently
- D
Enable Network Discovery and File and Printer Sharing for all profiles to make the workstation reachable again
Show answer and explanation
Correct answer: B
Explanation
The best answer is to create a specific inbound firewall exception for the application or its required port on the Private profile. This matches standard Windows security best practices: leave the host firewall enabled, scope access only to what is required, and apply the rule only to the appropriate network profile. In Windows, Microsoft Defender Firewall supports separate Domain, Private, and Public profiles, and administrators should avoid disabling a profile just to troubleshoot application connectivity. A targeted inbound rule is the preferred approach because it restores functionality without unnecessarily exposing the workstation. This aligns with guidance in Microsoft documentation for Microsoft Defender Firewall and Windows Defender Firewall with Advanced Security, which emphasizes profile-based configuration and least-privilege rule creation.
- A. Incorrect.
This is incorrect because disabling the firewall for the Private profile is broader than necessary and violates the requirement to restore access with minimal exposure. Best practice is to keep the host firewall enabled and create a specific allow rule for the needed application or port instead of removing protection for the entire profile.
- B. Correct.
This is correct because it restores the application's inbound connectivity while following least-privilege principles. In Windows Defender Firewall with Advanced Security, creating a narrowly scoped inbound rule for the specific application or required port and limiting it to the Private profile is the appropriate fix when a local OS firewall is blocking legitimate traffic on a trusted LAN.
- C. Incorrect.
This is incorrect because changing the network profile to Public would typically apply more restrictive firewall settings, making inbound access less likely to work. It also does not directly address the blocked application and could create additional connectivity issues for other trusted local services.
- D. Incorrect.
This is incorrect because Network Discovery and File and Printer Sharing are specific sharing-related firewall groups, not a targeted fix for a third-party accounting application's inbound requirements. Enabling them for all profiles is overly broad and does not guarantee the application's needed port or executable is allowed.