A new DMZ web server needs to communicate with an internal database server on port 1433 (MSSQL). The security team must allow this while maintaining least-privilege firewall rules. Which rule set is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
You want the rule that only lets the web server's IP talk to the database server's IP on TCP 1433, denies all other DMZ-to-internal traffic, and logs attempts. That's least privilege, not blanket access.
Full Explanation
The correct rule set is the one that specifies the exact source (the web server IP), the exact destination (the database server IP), and the exact protocol and port (TCP 1433), while denying all other traffic from the DMZ to the internal network and logging all DMZ-to-internal connection attempts. This enforces least privilege by allowing only the required database communication and by providing visibility into any other attempted access. The rule allowing any source to any destination is wrong because it eliminates network segmentation entirely. The rule allowing the entire DMZ subnet to reach the entire internal subnet on all ports is wrong because it is far broader than required. The rule allowing the web server IP to reach any internal host on port 1433 is wrong because it could expose all internal MSSQL servers to a compromised web server.