Halcyon Clinics exposes an appointment portal through a perimeter firewall. After a maintenance window, a test laptop reaches the patient database directly. The network lead points to a later database-deny rule and calls the test impossible; the deployed policy starts with a temporary permit from any source to any destination on every protocol.
Your job is to reconstruct which packets actually pass, separate public, application, and data trust zones, and specify evidence that survives a quarterly access review. A firewall diagram describes intent, not effective enforcement: rule order, connection state, alternate routes, and the location of inspection all affect the result.
Test a forbidden path as well as a permitted path. A working portal does not prove that the database is isolated.
Packet decisions: state, order, and default denial
A stateless filter evaluates each packet against fields such as source address, destination address, protocol, and ports. If a client uses TCP source port 52000 to reach server port 443, return traffic has source port 443 and destination port 52000; a stateless policy needs an appropriate reverse-direction allowance. A stateful firewall tracks connection tuples and protocol state so a response can be admitted for an allowed connection without opening all high-numbered ports to unsolicited traffic. State tracking is not proof of user identity or inspection of encrypted application content.
In a first-match rule set, evaluate top to bottom and stop at the first match. Rule 10 permitting any source, destination, and service makes rule 20 denying access to the database unreachable for matching new connections. An any-any rule is not rescued by a later specific deny. Implicit deny rejects traffic that matches no allow rule; its logging behavior must be configured or verified separately. Confirm the actual engine's semantics rather than assuming all policy systems use first match, and account for existing connection state when testing a rule change.
For least-privilege and change-control evidence, retain the ordered deployed configuration, change approval, rule identifiers, and timestamped positive and negative connection tests. An auditor can ask which effective rule allowed a sampled flow and whether an expired emergency allowance was removed from every enforcement point, not merely deleted from a proposed policy.
An early broad permit prevents later restrictions from controlling the same new connection.
Trust zones, DMZs, and workload boundaries
Segmentation divides systems into zones with enforced communication boundaries. A separate subnet or VLAN is not sufficient if routing still permits every inter-zone flow. A DMZ is a constrained zone for public-facing services: permit Internet clients to its web listener on TCP 443, permit only the web tier to the internal application listener on TCP 8443, and permit only the application tier to the database on TCP 5432. Do not give the DMZ direct database or management access simply because the web tier needs a backend.
Microsegmentation applies finer-grained policy between workloads, including peers in the same broad zone. Two application instances may both reach the database yet be prohibited from initiating sessions to one another. Enforce policy on every usable path, including host interfaces and alternate routes; an unenforced diagram boundary provides no containment. Identify dependencies before rollout, then verify denied lateral paths alongside allowed business flows to avoid both outages and accidental broad exceptions.
Zero trust means no implicit trust from network location or asset ownership: explicitly authenticate and authorize access to resources, apply least privilege, and reassess using identity, device posture, and session context. A private address is not an authorization credential, and microsegmentation alone is not a complete zero trust architecture. Evidence includes a dependency matrix, enforced workload policies, authorization decisions, and tests from a compromised-zone perspective. Ask whether a stolen workload identity can cross a boundary that an address-only diagram labels safe.
A DMZ limits public exposure while workload policy constrains lateral movement inside the private network.
Detection is not prevention
An IDS observes traffic and raises detections, often from a mirrored feed outside the forwarding path. An IPS is inline and can drop matching traffic before delivery. A detection-only sensor reporting an exploit signature does not establish that an attack was blocked. Conversely, an inline device configured only to alert is not providing prevention for that signature. Record placement, mode, signature version, and action when interpreting events.
Inspection has limits: encrypted payloads may hide application attacks unless a deliberately governed decryption point exists, and asymmetric routing can deprive a sensor of half a conversation. Inline deployment also needs capacity and failure-mode decisions: fail-open favors availability while fail-closed favors blocking at the risk of service loss. Test both detection and enforcement with controlled traffic rather than treating an alert dashboard as a prevention certificate.
Map monitoring and intrusion-prevention controls to the claims actually supported. For a sampled event, preserve sensor configuration, matched signature, observed action, and destination-side corroboration. An auditor asking 'did the packet arrive?' needs more than a signature name or the appliance's advertised capabilities.
Flow logs and defensible rule reviews
A flow record commonly aggregates a time interval, source and destination addresses, ports, protocol, byte and packet counts, and an accept or reject action at an observation point. It is not a packet capture and generally lacks application payloads. An accepted TCP 443 flow proves a network decision at that point, not successful authentication or authorization. Interpret direction, translation stage, sampling, delivery delay, clock alignment, and collection coverage before joining it to a firewall rule or application event.
For a 90-day rule review, reconcile the complete deployed rule population to owners and approved purposes. Examine broad sources, destinations, services, shadowed entries, emergency expiry dates, and unused rules. Zero hits in a partial or disabled logging window is not proof that a rule is unnecessary. Check seasonal jobs and dependencies, stage removal with rollback, and test both business connectivity and prohibited paths after deployment.
A review evidence package includes dated configuration exports with scope and integrity metadata, the log coverage window and gaps, reviewer decisions per rule, linked approvals, exception expiry, and deployed removal evidence. A signed summary alone cannot demonstrate population completeness. An auditor should be able to trace one rule from business need through approval, observed use or justified inactivity, reviewer decision, and resulting configuration.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: The deny that never runs
Scenario sim+70 XP
Read the brief and answer both questions.
Incident brief
A first-match firewall evaluates new connections using rule 10 permit any source to any destination on every service, followed by rule 20 deny Internet traffic to the database. The administrator says the later rule is more specific and therefore wins. The policy also drops unmatched traffic at its end.
Term bank, not all of these are right
1020implicit denylongest prefix
1.1Which numbered rule decides a new Internet-to-database connection? (a number)
1.2What is the name of the end-of-policy behavior for unmatched traffic? (two words)
Task 2: An alert is called a block
Scenario sim+70 XP
Read the brief and answer both questions.
Incident brief
An out-of-band sensor receives mirrored traffic, raises alerts, and has no ability to interrupt forwarding. A manager labels it 'prevention' after an exploit alert. Meanwhile the permitted web connection and its tracked return packets traverse a firewall that maintains a connection table, not independent reverse-direction permit rules.
Term bank, not all of these are right
IDSIPSstatefulstateless
2.1Which sensor category describes the mirrored, alert-only device? (one acronym)
2.2Which firewall category explains the connection-table return handling? (one word)
Task 3: Private does not mean trusted
Scenario sim+70 XP
Read the brief and answer both questions.
Incident brief
The public web server occupies a separate constrained perimeter zone. An engineer calls it the trusted core. Within the private application subnet, workload-specific controls deny peer-to-peer initiation while allowing each instance to reach an approved database service. The engineer says this is only ordinary subnet separation.
Term bank, not all of these are right
DMZLANmicrosegmentationrouting
3.1What is the conventional name of the constrained public-facing zone? (one acronym)
Halcyon Clinics needs a machine-readable target plan for its portal boundary. The change requester says a private database address and an alerting mirror sensor already provide prevention, so retaining the emergency any-any allowance would be harmless.
Fill the fixed plan fields using the approved dependency sheet. These are target decisions, not a complete device configuration. Preserve only the specified application-to-database initiation, select connection-aware filtering, remove the broad allowance, and define usable review evidence.
Approved dependency sheet and evidence requirements
Public listener zone: DMZ
Application subnet: 10.40.20.0/24
Database host: 10.40.30.8/32
Only database initiation: application subnet -> database host, TCP 5432
Return handling: connection table; no blanket reverse ephemeral-port opening
Unmatched traffic: deny
Emergency any-any: must not remain enabled
Threat requirement: inline blocking, not a mirrored alert feed
Evidence: flow logging enabled; review every 90 days; record rule owner and approval
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
Checks
Public listener has the approved boundary role
Filtering and default action enforce constrained initiation
Emergency broad access is disabled
Database dependency has exact endpoints and service
Inspection can block inline
Logging and accountable periodic review are specified
The network lead claims the quarterly review is complete because every row has an attachment. Judge whether each independent row supports its stated claim; no row supplies missing evidence for another.
Reject a row for its single primary defect: broad-access for unrestricted initiation, detection-not-prevention for an alert-only blocking claim, incomplete-coverage for a missing observation period, or missing-approval for an unapproved access change. Accept rows that substantiate their stated limited claim.
Verdicts are accept or reject. Every rejection needs one reason code from: broad-access | detection-not-prevention | incomplete-coverage | missing-approval.
Six independently sampled review rows
NSA-1 | Claim: approved web access only. Deployed source Internet, destination DMZ web host, TCP 443; named owner, approval, and successful allow/deny tests attached.
NSA-2 | Claim: least privilege. Deployed first rule permits every source, destination, and service indefinitely; owner and approval exist.
NSA-3 | Claim: exploit blocked. Mirrored alert-only sensor reported a signature; event has no forwarding action. Full-period records exist.
NSA-4 | Claim: rule safely unused over 90 days. Zero hits reported, but collection was disabled for 70 days; owner and approval exist.
NSA-5 | Claim: authorized new admin access. Narrow rule and complete tests exist, but no approval was requested or recorded.
NSA-6 | Claim: reviewed database dependency remains justified. Exact application-to-database tuple, named owner, current approval, full 90-day flow coverage, signed decision, and deployed snapshot attached.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Checks
Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code
Next on your path · Networking Fundamentals
Networking Fundamentals Capstone
Allocate a verified VLSM plan, enforce zone boundaries, and test an ordered firewall policy against permitted flows.
