Exam 70-744 topic 1 question 91 discussion

Actual exam question from Microsoft's 70-744

Question #: 91
Topic #: 1

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this sections, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your network contains an Active Directory domain named contoso.com. The domain contains a computer named Computer1 that runs Windows10.
The network uses the 172.16.0.0/16 address space.
Computer1 has an application named App1.exe that is located in D:\Apps\. App1.exe is configured to accept connections on TCP port 8080.
You need to ensure that App1.exe can accept connections only when Computer1 is connected to the corporate network.
Solution: You run the New-NetFirewallRule -DisplayName "Rule1" -Direction Inbound
-LocalPort 8080 -Protocol TCP -Action Allow -Profile Domain command.
Does this meet the goal?

A. Yes
B. No

Show Suggested Answer

Suggested Answer: B 🗳️

by Kamikazekiller at Aug. 9, 2020, 3:07 p.m.

Comments

Submit Cancel

c3r3br4l

4 years, 5 months ago

Answer is correct. The question asks if this meets the goal of allowing it only when it's connected to the corporate network. This would need to be a deny rule for the private (or private and public) firewalls

upvoted 1 times

...

Ameer_Hamza

4 years, 6 months ago

correct

upvoted 1 times

...

Thedude30

4 years, 6 months ago

This part is key "App1.exe is configured to accept connections on TCP port 8080" CONFIGURED. So answer is Yes. You just need to allow inbound on 8080 and app is listening already

upvoted 3 times

...

SamsOtro

4 years, 6 months ago

Kind of question that makes people resent MSFT. Yes it works using just the port and I'd agree with jam7272, except that there is a very similar question coming up that uses the layer 7 filter instead of the port. I'm guessing that means answer to this one is no.

upvoted 2 times

...

jam7272

4 years, 7 months ago

Ok. I've run this in a lab and the command - New-NetFirewallRule -DisplayName Rule1 -Direction Inbound -LocalPort 8080 -Protocol TCP -Action Allow -Profile Domain - definitely works. I know that's not the debate here. But it does allow port 8080 TCP Inbound on the Domain profile. That is what the application needs to communicate. So I would go with 'yes'. UNLESS the question says that that app is the only app that should be allowed to communicate via the rule, in which case the answer would be 'no'.

upvoted 4 times

Matt71

4 years, 5 months ago

jam7272 I do agree with you. If there is no condition like "only this app" the rule does the job.

upvoted 3 times

...

Yebubbleman

4 years, 5 months ago

The question clearly states: "You need to ensure that App1.exe can accept connections only when Computer1 is connected to the corporate network." The firewall rule allows traffic when on the domain profile, but does not do anything to disallow it on any other network profile, making the given answer correct.

upvoted 1 times

...

jam7272

4 years, 7 months ago

This would actually work without .exe but it would allow all traffic on 8080 TCP inbound - https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=win10-ps - the question is, does that make the answer wrong? Technically it is correct because it will allow the app to communicate, but it's not least privilege...

upvoted 1 times

...

KidCastaldo

4 years, 8 months ago

Agree, you need to put the .EXE in the rule

upvoted 1 times

...