Exam CS0-002 topic 1 question 285 discussion

A firewall rule is best suited to resolve this issue. The question stated that remote access to certain ports to the server was enabled for the purpose of vendor support. This means that that port was opened at the firewall, leaving it vulnerable to scans and unwanted traffic. Configuration changes to the firewall must be made to implement a logic like this: PERMIT traffic from vendor to application server on those required ports DENY any other traffic. Option A is more specific than Option E since E doesn't state how networks will be blocked.

Wouldn't it make sense to permit 1 network and deny all in the firewall rules ? instead of blocking MANY networks when there could possibly be more you would have to update ?

I strongly vote for E

I would go for E. Block the unauthorized networks. . It is more specific then A that is too general - it does not say what kind of firewall rule to apply.

It may be difficult to determine which networks are unauthorized (E), and it could potentially block legitimate traffic. Applying a firewall rule to restrict traffic to authorized networks and ports is a more effective and targeted approach -> (A)

E using a firewall

E is Correct

E. Block the unauthorized networks. To resolve this security issue while still allowing remote vendor access, blocking the unauthorized networks that are receiving large amounts of data through the open ports is the best solution. This will prevent the data from being sent to the unauthorized networks while still allowing the vendors to access the server remotely. Applying a firewall application server rule, adding the application server to the allow list, sandboxing the application server, or enabling port security will not necessarily address the issue of unauthorized data transfer to the outside network.

A makes more sense here.

I wonder if by A they mean an Application Proxy? That would make sense but other than that it would be D.

E. is correct

i think its E

The best answer is E. Block the unauthorized networks. This would prevent any data from being sent to these unauthorized networks and reduce the risk of data exfiltration.