220-1102 Question 359
Single answerFirewallA small office recently enabled Windows Defender Firewall with Advanced Security on all Windows 11 laptops. After the change, a line-of-business inventory application can no longer receive updates from the vendor's server, but only when employees are working from home. In the office, the application works normally. You verify that the application requires inbound connections on TCP port 8443 to a local service running on each laptop. The company wants to restore functionality for remote users while maintaining the strongest practical security posture. What is the BEST action to take?
- A
Create an inbound firewall rule allowing TCP 8443 for the application only on the Private profile
- B
Disable Windows Defender Firewall when users are connected to home networks
- C
Create an inbound firewall rule allowing TCP 8443 for the application on the Public profile, limited to the specific program or service
- D
Open TCP 8443 on the office perimeter firewall so home users can reach the vendor server
Show answer and explanation
Correct answer: C
Explanation
The key detail is that the application works in the office but fails at home, indicating a difference in firewall profile or local host-based firewall behavior rather than a general application failure. Windows Defender Firewall uses profiles such as Domain, Private, and Public, and home or unfamiliar networks are often treated as Public. If the application requires inbound traffic to a local listener on the laptop, the correct remediation is to create an inbound rule that applies to the Public profile for remote use. To maintain security, the rule should be narrowly scoped to the specific executable or service rather than opening the port for all programs. This aligns with Microsoft best practices for Windows Defender Firewall with Advanced Security: allow only necessary traffic, scope rules as tightly as possible, and avoid disabling the firewall unless absolutely necessary for testing.
- A. Incorrect.
This is incorrect because the issue occurs specifically when users are working from home, where Windows commonly classifies the network as Public unless it is explicitly configured otherwise. A rule applied only to the Private profile may not be active on those home connections, so the application would likely remain blocked.
- B. Incorrect.
This is incorrect because disabling the host firewall reduces endpoint security and is not a best practice for resolving a single application connectivity issue. The safer approach is to create a narrowly scoped rule that permits only the required traffic. CompTIA A+ objectives emphasize proper firewall configuration rather than turning protections off.
- C. Correct.
This is correct because the laptops need to accept inbound TCP 8443 traffic while connected to home networks, which are commonly treated as Public networks by Windows Defender Firewall. Limiting the rule to the specific program or service follows the principle of least privilege and is more secure than allowing the port broadly for all applications.
- D. Incorrect.
This is incorrect because the problem is on the client laptops' host firewalls, not the office edge firewall. The application works in the office, which suggests the vendor connectivity and office perimeter settings are already functional. Opening a port on the company perimeter firewall would not fix inbound blocking on remote users' individual systems.