CyberCertPrepNetwork FundamentalsNetwork Security BasicsEASYFree question
A junior admin notices that every firewall rule on the perimeter explicitly allows or denies specific traffic, but there is no final catch-all rule listed. What happens to traffic that does not match any rule?
- A.It is allowed because no rule explicitly denies it
- B.It is dropped by an implicit deny-all at the end of every rule set
- C.It is queued and inspected by a secondary IPS
- D.It is forwarded to the default VLAN for further review
Why B is correct
Firewall rule sets always end with an implicit (hidden) deny-all. Any packet not matched by a preceding permit rule is silently dropped. This 'deny by default' principle is foundational to secure firewall design. Option A is incorrect -- no match does not mean allow. Option C is wrong -- there is no automatic IPS queue for unmatched packets. Option D is incorrect -- unmatched traffic is not forwarded to a VLAN.
Know someone studying for Network Fundamentals? Send them this one.