ITPEC FE Subject B April 2024 Question 20

Topic: Security Scenarios

From the answer group below, select the correct combination of answers to be inserted into A through C in the description.

A zone is a group of interfaces that have similar functions or features. Zones establish the security borders of a network. A zone defines a boundary where traffic is subjected to policy restrictions when crossing into another region of a network. An inspection policy is applied to traffic moving between zones. Inter-zone policies offer considerable flexibility. Hence, different inspection policies can be applied to multiple host groups connected to the same router interface.

Company Z, intends to apply a zone-based policy firewall in their datacenter. Thus, they develop the network topology shown in Figure 1.

The InternetPRIVATE zonePC-1PC-nPUBLIC zoneDMZ zoneServer-1Server-n

Figure 1 Network topology

These zones have the following characteristics:

  • •The DMZ zone represents a zone where servers accessed from the Internet are located. Even if a server in the DMZ zone is breached, direct access to the internal PCs of the datacenter is prevented.
  • •The PUBLIC zone represents the entire network outside the datacenter.
  • •The PRIVATE zone represents the internal network. All datacenter PCs are located in this zone.

The security policy for the datacenter should be:

  • •Hosts in the A zone cannot connect to hosts in the B zone.
  • •Hosts in the A zone can only access the DNS service on all hosts in the C zone and HTTP/HTTPS service on limited hosts in the C zone to retrieve software updates.
  • •Hosts in the B zone can connect to hosts in the A zone on all TCP, UDP and ICMP services.
  • •Hosts in the B zone can reach the C zone but not vice versa.
  • •Hosts in the C zone can reach HTTPS service on hosts in the A zone. This policy will restrict access to other services available on each server.

Answer group

OptionABC

Explanation

A: DMZ, B: PRIVATE, C: PUBLIC — the servers may not reach the internal PCs, the PCs may reach everything, and the Internet reaches only HTTPS on the servers.

Two clues fix the zones. Rule 5 says blank A holds servers ("other services available on each server"), and the DMZ description says a breached server must not reach the internal PCs, which is rule 1 with A as DMZ and B as PRIVATE. The remaining zone, C, is PUBLIC. Every rule then reads sensibly:

RuleWith A = DMZ, B = PRIVATE, C = PUBLIC
1DMZ servers cannot connect to the internal PCs
2Servers may use DNS on the Internet and HTTP/HTTPS on update sites only
3Internal PCs may reach the servers on any service, for administration
4PCs may reach the Internet, but the Internet cannot open connections to them
5Internet users reach only the HTTPS service of the servers

Answer (b)

Why not others:

  • •(a) — with B as PUBLIC and C as PRIVATE, rule 4 lets the Internet reach the internal PCs and rule 3 opens every DMZ service to the Internet
  • •(c) — with A as PRIVATE and B as DMZ, rule 3 lets DMZ servers connect to the PCs on all services, the very access a breached server must not have
  • •(d) — with A as PRIVATE and B as PUBLIC, rule 3 lets the whole Internet connect to the PCs on all services
  • •(e) — with B as DMZ and C as PRIVATE, rule 4 lets DMZ servers reach the PCs
  • •(f) — with A as PUBLIC and C as DMZ, rule 2 has Internet hosts retrieving software updates from company Z's servers, and rule 5 places the protected servers on the Internet instead of in the DMZ

Key rule: In a zone-based firewall the DMZ is reachable from both sides but never opens connections inward; the internal zone initiates, and the Internet reaches only the published services.

Security Scenarios · AI-written, may contain errors

Practice this exam

This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.