A security engineer is configuring egress filtering on the corporate firewall. Which approach BEST represents a defensible egress policy?
Select an answer to reveal the explanation.
Short Explanation
You want a default-deny egress policy that only allows required protocols, like HTTP, HTTPS, and DNS, to approved destinations. That limits exfiltration opportunities and restricts command-and-control callback channels while still supporting normal business traffic.
Full Explanation
The correct approach is to allow only specific protocols (HTTP, HTTPS, DNS) to approved destinations and deny all other outbound traffic by default. This default-deny egress posture limits exfiltration and command-and-control callback channels while permitting needed web and DNS traffic. Allowing all outbound traffic initiated from internal hosts and denying all inbound-initiated connections is wrong because it provides no egress control and lets attackers beacon out freely. Performing deep packet inspection on all inbound traffic only is wrong because it misses data exfiltration and outbound command-and-control communication. Blocking all outbound traffic on ports above 1024 while allowing well-known service ports is wrong because it still allows common command-and-control channels on ports 80 and 443.