An organization deploys host-based firewalls on all Windows workstations. Which Windows Firewall with Advanced Security configuration best limits lateral movement?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because blocking inbound connections between workstations prevents peer-to-peer lateral movement techniques (SMB spreading, WMI execution, RDP); allowing inbound only from management systems and outbound to approved services enforces least-privilege networking at the host level. A is wrong because allowing all traffic eliminates the security benefit of host-based firewalls.
Full explanation below image
Full Explanation
B is correct because blocking inbound connections between workstations prevents peer-to-peer lateral movement techniques (SMB spreading, WMI execution, RDP); allowing inbound only from management systems and outbound to approved services enforces least-privilege networking at the host level. A is wrong because allowing all traffic eliminates the security benefit of host-based firewalls. C is wrong because disabling host firewalls and relying only on perimeter controls fails once the perimeter is bypassed; host firewalls are a critical defense-in-depth layer for internal east-west traffic. D is wrong because blocking only internet source IPs leaves internal lateral movement pathways fully open.