An office firewall permits only the office subnet to reach the servers and contains no explicit deny rule. Guest traffic matches no rule and is dropped. Which behavior drops it?
Select an answer to reveal the explanation.
Short Explanation
A bouncer with one guest list does not need a second list of people to refuse. You permitted only the office subnet, guest traffic matches nothing, and the firewall's implicit deny at the end of the rule set drops it. The permit does not itself refuse everyone else, and a default permit would have let the guests through.
Full Explanation
Firewall rule sets are evaluated in order, and when a packet matches no permit it hits the implicit deny that ends the policy. The office firewall has a permit for the office subnet toward the servers and no explicit deny. Guest traffic matches nothing, so the implicit deny drops it. An explicit deny of the guest subnet would also drop that traffic, and the stem says the policy contains no explicit deny. That written deny is the rule people expect to see and do not need. A default permit at the end would forward the guests, which is the opposite of the drop. The office permit allows the office subnet. A permit does not drop the sources it fails to name. Those packets fall through to the implicit deny. Exam caveat: an implicit deny does not log unless logging is enabled. If guest drops are invisible, the cause can still be the default deny. Operational check: list the rule set in order, confirm the office permit matches office sources, confirm there is no explicit guest deny, and confirm a guest test packet is dropped.