N10-009 Question 279
Single answerSecurity rules: Access control list (ACL), Uniform Resource Locator (URL) filtering, Content filteringA company allows its marketing team to access social media sites for business purposes, but the rest of the staff should be blocked from those sites during work hours. The security team also wants to prevent users from downloading executable files from any website, while still allowing access to general web content needed for daily work. Which solution best meets these requirements with the LEAST disruption to legitimate traffic?
- A
Create an ACL on the edge firewall that blocks all HTTPS traffic to the internet except for the marketing subnet
- B
Implement URL filtering policies by user group for social media categories and apply content filtering to block executable file downloads
- C
Use a router ACL to deny TCP ports 80 and 443 for all users except marketing, then allow DNS for everyone
- D
Configure a host-based firewall on each workstation to block outbound traffic to social media IP addresses and allow all file downloads
Show answer and explanation
Correct answer: B
Explanation
The best answer is to combine URL filtering and content filtering. In real environments, ACLs are best suited for controlling traffic based on source/destination IP, protocol, and port, but they are not ideal for identifying business-use web categories such as social media over HTTPS. URL filtering is a standard security control used on next-generation firewalls, secure web gateways, and proxy appliances to enforce acceptable use policies by category or group. Content filtering is used to inspect or control the type of material being transferred, such as blocking executable downloads to reduce malware risk. This layered approach aligns with common enterprise security best practices and with vendor guidance from platforms such as Palo Alto Networks, Cisco Secure Web Appliance/Umbrella, Fortinet, and similar secure web filtering solutions, which distinguish between network-layer ACLs and application/content-aware web security policies.
- A. Incorrect.
This is incorrect because blocking all HTTPS traffic except for the marketing subnet would stop nearly all modern web access for non-marketing users, not just social media. An ACL is useful for IP/port-based control, but it cannot reliably distinguish social media sites from other HTTPS destinations by category or page type. This approach would cause major business disruption and does not address blocking executable downloads specifically.
- B. Correct.
This is correct because URL filtering is designed to allow or deny web access based on site category, domain, or reputation, which fits the requirement to let only the marketing team reach social media sites. Content filtering can inspect and enforce rules on web content types, such as blocking executable file downloads while still allowing normal browsing. Using policy-based controls tied to user groups is more precise and creates less collateral impact than broad ACL-based blocking.
- C. Incorrect.
This is incorrect because denying ports 80 and 443 for most users would effectively remove general web access rather than selectively blocking social media. This is a common misconception: ACLs can restrict ports and addresses, but they do not provide the application-layer awareness needed for category-based web control. Allowing DNS alone does not help users browse if web ports are blocked.
- D. Incorrect.
This is incorrect because host-based firewall rules on each workstation are difficult to manage consistently at scale and typically do not provide reliable URL category filtering. Blocking by social media IP address is also unreliable because many cloud-hosted services use changing IP ranges and content delivery networks. In addition, this option explicitly allows all file downloads, which fails the requirement to block executable files.