Parks wants ICMP allowed for monitoring between environments but must not allow RDP. What should the administrator write?
Select an answer to reveal the explanation.
Short Explanation
Any-any is a master key; ICMP-only is a labeled spare. Write the monitoring allow on ICMP and keep RDP out of the path. Gateway-only thinking and treating ping as malware miss the least-privilege service list.
Full Explanation
Parks monitoring that needs ICMP between environments without allowing RDP requires explicit allow for ICMP and deny or omit RDP using specific services—not a default any-any. Specific services keep monitoring alive while remote desktop stays closed across civic environment boundaries.
A single any-any allow so monitoring and RDP both work defeats least privilege. Claiming gateway firewall only is required because ICMP never hits Distributed Firewall is false—ICMP can be matched on DFW. A Carbon Black Cloud prevention policy that treats ICMP as malware confuses endpoint detections with intentional network monitoring allows.
Exam caveat: write the narrow service allows you mean; any-any “for monitoring” is a classic wrong answer.
Operational check: publish ICMP allow between the intended environment groups, verify ping works, verify RDP is denied or absent, and capture service objects in the parks monitoring standards.
Specific ICMP allows with RDP omitted keep parks monitoring honest. Add logging on the ICMP allow and on RDP denies between environments, sample weekly for surprise RDP attempts, and treat any any-any monitoring exception as a time-boxed risk accepted by parks leadership only.