SY0-701 Question 319
Single answerFirewall: Rules , Access lists , Ports/protocols , Screened subnetsA company hosts a public web application in a screened subnet (DMZ). The web server must be reachable from the internet over HTTPS only, and administrators must manage the server from a hardened jump box on the internal network using SSH. Security policy states that systems in the screened subnet must not initiate connections directly to the internal network except for approved management traffic. During a firewall review, an administrator finds that the current rules are too permissive. Which firewall rule set BEST meets the requirements while following least-privilege principles?
- A
Allow any inbound traffic from the internet to the web server, allow the web server to initiate any outbound traffic to the internal network, and rely on host-based firewalls for restriction.
- B
Allow inbound TCP 443 from the internet to the web server, allow inbound TCP 22 from the jump box to the web server, deny all other traffic from the internet to the screened subnet, and deny connections initiated from the screened subnet to the internal network except established return traffic.
- C
Allow inbound TCP 80 and 443 from the internet to the web server for flexibility, allow RDP from any internal workstation to the web server for administration, and block all outbound traffic from the web server.
- D
Allow inbound TCP 443 from the internet to the jump box, allow the jump box to forward SSH to the web server, and permit the web server to connect to the internal network over any port so logs can be sent to multiple services.
Show answer and explanation
Correct answer: B
Explanation
The best answer is the rule set that implements least privilege and proper screened subnet segmentation. In a typical DMZ design, public-facing services are placed in a separate network segment so internet users can reach only the necessary service ports, while internal resources remain isolated. For this scenario, the firewall should allow inbound HTTPS (TCP 443) from the internet to the web server and restricted administrative SSH (TCP 22) only from the designated internal jump box. All other unsolicited traffic to the screened subnet should be denied. The firewall should also prevent hosts in the screened subnet from initiating connections to the internal network, except where explicitly approved, while allowing established return traffic if the firewall is stateful. This approach reflects common best practices in network segmentation and firewall rule design, including default-deny, least privilege, and controlled administrative access. These principles are consistent with widely accepted guidance such as NIST SP 800-41 on firewalls and firewall policy, as well as general segmentation recommendations found in NIST network security publications.
- A. Incorrect.
This is incorrect because it violates least privilege and undermines the purpose of a screened subnet. Allowing any inbound traffic from the internet to the web server exposes unnecessary services and increases attack surface. Allowing the web server to initiate any outbound traffic to the internal network also breaks segmentation and could enable lateral movement if the DMZ host is compromised. Host-based firewalls can add defense in depth, but they should not replace properly scoped network firewall rules.
- B. Correct.
This is correct because it permits only the required services and enforces segmentation between the internet, screened subnet, and internal network. TCP 443 allows public HTTPS access to the web application. TCP 22 limited to the hardened jump box supports controlled administrative access. Denying all other internet-to-DMZ traffic prevents unnecessary exposure, and denying DMZ-initiated connections to the internal network except established return traffic aligns with least privilege while still supporting stateful firewall behavior for legitimate sessions.
- C. Incorrect.
This is incorrect because the scenario requires HTTPS only, so allowing TCP 80 is broader than necessary unless specifically needed for redirect behavior, which is not stated here. Allowing RDP from any internal workstation is also too permissive and does not follow the requirement to use a hardened jump box. Blocking all outbound traffic from the web server could also interfere with legitimate return traffic unless the firewall is stateful and specifically allows established sessions; as written, this option is not the best fit.
- D. Incorrect.
This is incorrect because the public web server in the screened subnet, not the jump box, must be reachable from the internet over HTTPS. Exposing the jump box to the internet is poor practice for this scenario. In addition, permitting the web server to connect to the internal network over any port directly contradicts the stated policy that DMZ systems must not initiate connections to the internal network except approved management traffic.