Question

During a review of a perimeter firewall, an IS auditor finds that the rule base ends with an explicit 'permit any any' statement placed after several specific deny rules. Which of the following is the auditor's GREATEST concern?

Accepted Answer

Traffic not matching the specific deny rules will be allowed through, undermining the default-deny principle

Answer

The specific deny rules will slow packet processing and degrade throughput

Answer

Logging of denied traffic will consume excessive storage on the firewall

Answer

The firewall cannot perform stateful inspection with this rule ordering