ITPEC FE Subject B April 2024 Question 20
ITPEC FE Subject B April 2024 — Question 20 of 20
A zone-based policy firewall groups interfaces into zones and enforces rules on inter-zone traffic. A typical datacenter has three zones:
- •DMZ — hosts Internet-facing servers (web, DNS); isolated buffer zone
- •PRIVATE — internal PCs, most protected
- •PUBLIC — the external Internet
To solve zone-mapping problems, test each policy rule against the candidate mapping:
| Rule in problem | Mapping (A=DMZ, B=PRIVATE, C=PUBLIC) | Why it fits |
|---|---|---|
| A cannot connect to B | DMZ cannot reach PRIVATE | DMZ servers must not initiate connections to internal network |
| A can only access DNS and limited HTTP/HTTPS in C | DMZ can reach PUBLIC for DNS and software updates | Servers pull OS/package updates from external repositories |
| B can connect to A on all TCP/UDP/ICMP | PRIVATE can reach DMZ on all services | Admins manage DMZ servers via SSH, monitoring, etc. |
| B can reach C but not vice versa | PRIVATE can reach PUBLIC, not reverse | Internal PCs browse Internet; Internet cannot reach PRIVATE |
| C can reach HTTPS on A | PUBLIC can reach HTTPS on DMZ | External users access web servers in DMZ |
Why not others:
- a) A=DMZ, B=PUBLIC, C=PRIVATE — rule 4 would mean PUBLIC→PRIVATE, a critical security violation
- c) A=PRIVATE — rule 3 would let DMZ connect to PRIVATE on all services, too permissive
- d) A=PRIVATE, B=PUBLIC — rule 3 allows PUBLIC→PRIVATE on all services, major violation
- e) A=PUBLIC, B=DMZ — rule 4 means DMZ→PRIVATE but not reverse; admins couldn't manage DMZ servers
- f) A=PUBLIC, B=PRIVATE — rule 1 blocks PUBLIC→PRIVATE (ok), but rule 3 lets PRIVATE connect to PUBLIC on all TCP/UDP/ICMP which is too broad, and rule 5 would mean DMZ→PUBLIC HTTPS only, missing the point
Key rule: DMZ servers need outbound access to PUBLIC for updates but must never initiate connections to PRIVATE. PRIVATE (admins) must be able to reach DMZ for management. PUBLIC users reach DMZ web servers, but never PRIVATE directly.
AI-generated — may contain errors
The original exam layout is preserved in the image so diagrams, formulas, tables, and code remain accurate.
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.