AP Cybersecurity Drill 13: Reading a Firewall Rule List

Question 1. A visitor on the internet tries to open the public website on port 443 (HTTPS). Which rule decides this connection, and what happens?

• A) Rule 5 denies this connection, because the request has come from an address out on the public internet
• B) Rule 2 denies this connection, because the request is being directed at the DMZ web server destination
• C) Rule 1 allows it, because it is the first rule that matches the source, the destination, and the port ✓
• D) Rule 4 denies this connection, because the public web server is treated as one of the bank's core systems

Explanation: Choice C is correct. The firewall acts on the first matching rule top to bottom; rule 1 matches any source to the DMZ web server on port 443 and allows it, so the connection is permitted before any later rule is reached. Choice A is incorrect. Rule 5 is the default and is only reached when no earlier rule matches, but rule 1 matches first. Choice B is incorrect. Rule 2 matches port 22, not the port 443 web request. Choice D is incorrect. Rule 4 concerns the core banking server, not the web server, so it does not match this connection.

Question 2. Someone on the internet tries to open an SSH session (port 22) to the web server. Which rule applies, and why does the result differ from a normal page visit?

• A) Rule 1 applies here, because rule 1 is the one rule that governs all traffic sent to the web server box
• B) Rule 3 applies here, because port 22 SSH is treated by this firewall as a branch-staff-only service line
• C) Rule 5 applies here, because an SSH connection will always fall through every earlier rule to the default
• D) Rule 2 denies it as the first match on port 22, while a page visit on 443 matches rule 1 first instead ✓

Explanation: Choice D is correct. Reading top to bottom, port 22 to the web server does not match rule 1 (port 443) but does match rule 2, which denies it; a page visit on port 443 matches rule 1 first and is allowed, so the two attempts hit different first-matching rules. Choice A is incorrect. Rule 1 matches only port 443, so it does not apply to the port 22 attempt. Choice B is incorrect. Rule 3 concerns the core banking server on the database port, not SSH to the web server. Choice C is incorrect. The SSH attempt matches rule 2 before ever reaching the default rule 5.

Question 3. A PC on the branch staff subnet connects to the core banking server on port 1521 (the database). A PC on the public guest Wi-Fi tries the same connection. How does the list treat each one?

• A) Both the staff PC and the guest Wi-Fi PC are allowed straight through to the database by rule 3
• B) The staff PC is allowed through by rule 3, while the guest Wi-Fi PC ends up being denied by rule 4 ✓
• C) Both the staff PC and the guest Wi-Fi PC are in the end denied through by the rule 5 default-deny entry
• D) The staff PC is denied by rule 4, while the guest Wi-Fi PC is allowed straight through by rule 3

Explanation: Choice B is correct. The staff PC matches rule 3 (branch staff subnet to the core banking server on 1521) and is allowed; the guest PC does not match rule 3, falls through to rule 4 (any source to the core banking server, any port), and is denied. Choice A is incorrect. Rule 3 matches only the branch staff subnet, so it cannot allow the guest PC. Choice C is incorrect. The staff PC matches rule 3 before reaching the default, so it is not denied by rule 5. Choice D is incorrect. The order is reversed: rule 3 allows the staff PC and rule 4 denies the guest PC.

Question 4. The analyst wants to let the branch staff subnet reach the web server's SSH port (22) for maintenance, without opening SSH to everyone. Which change achieves this while keeping the public denied?

• A) Add a rule above rule 2 allowing the staff subnet to the web server on port 22, leaving rule 2 to deny others ✓
• B) Delete rule 2 from the list entirely so that SSH on port 22 simply becomes open to the web server for all
• C) Change rule 1 so that, in addition to its current effect on 443, it also allows any source to connect on port 22
• D) Move the rule 5 default-deny entry from the bottom of the list all the way up to the very top of the list

Explanation: Choice A is correct. Because the firewall acts on the first match, inserting a narrower allow for the staff subnet on port 22 above the broad deny in rule 2 lets staff in while rule 2 still denies all other sources. Choice B is incorrect. Deleting rule 2 would open SSH to the entire internet, the opposite of keeping the public denied. Choice C is incorrect. Allowing any source on port 22 again exposes SSH to everyone. Choice D is incorrect. Moving the default deny to the top would block all traffic, including the public website.

Question 5. Reviewing the firewall's logs, the analyst sees repeated denied attempts from an internet address to the core banking server on many different ports. Which rule is generating those denials, and what should the analyst conclude?

• A) Rule 1 is denying them, and the reasonable conclusion is that the public website is down for maintenance
• B) Rule 3 is denying them, and the reasonable conclusion is that a branch staff member forgot their password
• C) Rule 4 denies them, and an outside source is probing the banking server across ports, worth investigating ✓
• D) Rule 2 is denying them, and the reasonable conclusion is that someone is visiting the public website normally

Explanation: Choice C is correct. An internet source to the core banking server on many ports does not match rule 3 and is caught by rule 4 (any source to the core banking server, any port, deny); repeated denials across ports look like port-scanning or probing that the list is blocking and the analyst should investigate. Choice A is incorrect. Rule 1 concerns the web server on 443, not the banking server, and denials are not a maintenance signal. Choice B is incorrect. Rule 3 allows the staff subnet; it does not generate these internet denials, and the pattern is not a forgotten password. Choice D is incorrect. Rule 2 concerns SSH to the web server, and many-port attempts on the banking server are not normal website visits.