Firewall PBQs: Understanding Cisco Cybersecurity Operations Fundamentals (200-201)

As a SOC analyst, you are reviewing the perimeter firewall rules after a security incident investigation. Your analysis of the firewall logs shows that the attacker used Telnet (port 23) from the internet to gain initial access to an internal server on the 192.168.1.0/24 subnet. Company policy mandates that only SSH (port 22) from the management subnet (10.0.0.0/8) is permitted for remote administration, and a default deny rule must be in place. Correct the firewall rules to prevent this type of attack.