An organization deploys host-based firewalls on all Windows workstations. Which Windows Firewall with Advanced Security configuration best limits lateral movement?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — b is correct because blocking inbound connections between workstations prevents peer-to-peer lateral movement techniques (SMB spreading, WMI execution, RDP); allowing inbound only from management systems and outbound to approved services enforces least-privilege networking at the host level. A is wrong because allowing all traffic eliminates the security benefit of host-based firewalls.
Full Explanation
B is correct because blocking inbound connections between workstations prevents peer-to-peer lateral movement techniques (SMB spreading, WMI execution, RDP); allowing inbound only from management systems and outbound to approved services enforces least-privilege networking at the host level. A is wrong because allowing all traffic eliminates the security benefit of host-based firewalls. C is wrong because disabling host firewalls and relying only on perimeter controls fails once the perimeter is bypassed; host firewalls are a critical defense-in-depth layer for internal east-west traffic. D is wrong because blocking only internet source IPs leaves internal lateral movement pathways fully open.