Palo Alto Networks Certified Cybersecurity Entry-level Technician (PCCET)Network SecurityHard
A network security team is implementing a new firewall policy that explicitly denies all traffic by default, and only allows specific, necessary traffic through explicit 'allow' rules. This approach aims to minimize the attack surface by ensuring that only authorized communication paths are open. Which security principle is this firewall policy primarily enforcing?
- ADefense in Depth
- BSecurity by Obscurity
- CLeast Privilege
- DZero Trust
Show answer & explanationAnswer & explanation
Correct answer: C. Least Privilege
The principle of least privilege dictates that a subject should be given only the minimum necessary rights or permissions to perform its function. Denying all traffic by default and only allowing specific, necessary traffic through explicit 'allow' rules on a firewall is a direct application of this principle to network communication.
Why the other options are wrong
- A. Defense in Depth uses multiple layers of security, but 'deny all, allow specific' is a specific policy principle.
- B. Security by obscurity relies on hiding information, which is not what explicit deny/allow rules do.
- D. Zero Trust is a broader model, but 'deny all, allow specific' is a fundamental tactic *within* Zero Trust, not the model itself.
Least Privilege
A security principle that requires that a subject (e.g., user, process, program) be granted only the minimum necessary rights or permissions to perform its function.
- Minimizes the potential damage from a security breach or error.
- Applies to user accounts, system processes, and network access.
- A fundamental tenet of secure system design and configuration.
Memory trick: Security principles are like wise rules for building a strong, safe house.