(ISC)2 Certified in Cybersecurity Practice Exam

What principle does a firewall use when there is no explicit rule for a certain type of traffic?

1. Least privilege

2. Separation of duties

3. Informed consent

4. Implicit deny

The correct answer is: Implicit deny

A firewall operates on the principle of implicit deny when it encounters traffic for which there is no explicit rule defined. This principle dictates that any traffic that is not explicitly allowed by a rule is automatically denied. The concept is built on the assumption that unless there is a clear permission in place, the default reaction is to block the traffic. This presumption enhances security by limiting exposure to potential threats. By denying traffic that hasn't been explicitly permitted, firewalls help protect networks from unauthorized access and attacks that exploit unfiltered data flows. This strategy is crucial for preventing any unintended access or communication that could harm a system or compromise sensitive data. The other principles listed—like least privilege, separation of duties, and informed consent—either focus on reducing unnecessary permissions, ensuring that roles and responsibilities are clearly defined, or obtaining user agreement, respectively, but they do not directly address how firewalls handle traffic that lacks explicit authorization.