PCNE Question 10

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  The correct answer is D. Create a new firewall rule with priority 65500 to deny all traffic, and enable logs. To see logs for blocked traffic, you need to enable logging for traffic explicitly denied by firewall rules. In this case, the existing rule allows only HTTP traffic, and since RDP is not allowed, it is being denied. However, without a specific deny rule with logging enabled, you won't see logs for the blocked traffic.

• Chose D3

  Choose option D. When you create a new firewall rule with priority 65500 and set it to deny all traffic, and then enable logging, you effectively create a "catch-all" rule that logs all denied traffic. This can be useful for troubleshooting and identifying traffic that is being blocked by the firewall. Here's the breakdown: Priority 65500: Firewall rules are processed in ascending order of priority. By setting the priority to 65500, this rule becomes one of the last rules to be evaluated, effectively serving as a catch-all rule after other rules have been checked. Deny All Traffic: This rule denies all traffic, including HTTP traffic, RDP traffic, and any other traffic. It acts as a safety net to catch and log any unexpected or unwanted traffic. Enable Logs: Enabling logging for this rule allows you to see entries in the firewall logs for any traffic that matches this rule.

• Chose D2

  Answer is D, it's the only way to capture anything that would have otherwise been denied by the default deny all implicit rule