A new DMZ web server needs to communicate with an internal database server on port 1433 (MSSQL). The security team must allow this while maintaining least-privilege firewall rules. Which rule set is most appropriate?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because the rule specifies the exact source (web server IP), exact destination (DB server IP), exact protocol and port (TCP 1433) — enforcing least privilege — with a default deny for all other DMZ-to-internal traffic and logging to detect violations. A is wrong because ALLOW any-to-any eliminates network segmentation entirely.
Full explanation below image
Full Explanation
B is correct because the rule specifies the exact source (web server IP), exact destination (DB server IP), exact protocol and port (TCP 1433) — enforcing least privilege — with a default deny for all other DMZ-to-internal traffic and logging to detect violations. A is wrong because ALLOW any-to-any eliminates network segmentation entirely. C is wrong because allowing all ports between two entire subnets is far broader than required. D is wrong because allowing the web server to reach any internal host on 1433 could expose all internal MSSQL servers to a compromised web server.