220-1102 Question 550
Single answerFirewall settingsA small business uses a line-of-business application on a Windows 11 workstation that must accept inbound connections from another PC on the same local network. After a recent security hardening change, users report that the application works locally but remote clients can no longer connect. You confirm the application service is running, both PCs are on the same subnet, and basic network connectivity works. The application vendor states the program listens on TCP port 8443. What is the BEST way to restore functionality while maintaining good security practice?
- A
Disable Microsoft Defender Firewall on the workstation so the application can receive inbound traffic
- B
Create an inbound rule in Windows Defender Firewall allowing TCP port 8443 for the application, limited to the appropriate network profile
- C
Create an outbound rule allowing TCP port 8443 from the workstation to all destinations
- D
Add the remote client's IP address to the workstation's DNS hosts file so the firewall can identify it
Show answer and explanation
Correct answer: B
Explanation
When an application must accept connections from other systems, the most secure and effective fix is to create a specific inbound firewall exception for the required port, protocol, application, and network profile. In this scenario, the service listens on TCP 8443, so the technician should configure an inbound allow rule for that traffic instead of weakening security by disabling the firewall. Microsoft best practices for Windows Defender Firewall emphasize using precise rules and appropriate profiles rather than broad exceptions. This aligns with standard A+ Core 2 troubleshooting: verify connectivity, identify the required service port, and modify firewall settings as narrowly as possible.
- A. Incorrect.
This is incorrect because disabling the host firewall removes an important security control and is not a best practice when a more targeted rule can solve the problem. On A+ Core 2, the expected approach is to allow only the specific traffic required rather than turning the firewall off entirely.
- B. Correct.
This is correct because the issue is inbound access to a service listening on TCP port 8443. A narrowly scoped inbound firewall rule is the proper fix. Limiting the rule to the correct network profile, such as Private or Domain if appropriate, follows least-privilege principles and reduces exposure.
- C. Incorrect.
This is incorrect because the problem is not with traffic leaving the workstation. The application needs to accept incoming connections, so an outbound rule would not address the blocked inbound session. This distractor reflects a common misunderstanding between inbound and outbound filtering.
- D. Incorrect.
This is incorrect because editing a hosts file affects name resolution, not firewall policy. Since connectivity and subnet configuration were already verified, and the vendor identified a listening TCP port, the issue is firewall filtering rather than DNS.