CyberCertPrepNetwork FundamentalsNetwork Security BasicsEASYFree question
A junior admin notices that every firewall rule on the perimeter explicitly allows or denies specific traffic, but there is no final catch-all rule listed. What happens to traffic that does not match any rule?
- A.It is allowed because no rule explicitly denies it; mutual TLS means the server presents two certificates, one per direction
- B.It is forwarded to the default VLAN for further review; ARP inspection validates replies against the STP topology database
- C.It is dropped by an implicit deny-all at the end of every rule set
- D.It is queued and inspected by a secondary IPS
Why C is correct
Firewall rule sets always end with an implicit (hidden) deny-all. Any packet not matched by a preceding permit rule is silently dropped. This 'deny by default' principle is foundational to secure firewall design. No match does not mean allow, so that choice is wrong. There is no automatic IPS queue for unmatched packets, so that choice is wrong. Unmatched traffic is not forwarded to a VLAN, so that choice is wrong.
Know someone studying for Network Fundamentals? Send them this one.