A college has a web server in a DMZ and an internal database server. A firewall controls traffic between the internet, the DMZ and the internal LAN. The net...

(a) A firewall monitors and filters network traffic according to a set of rules. It can allow authorised traffic and block traffic that should not enter or leave part of the network. [1 mark]

(b) The public web server is placed in the DMZ (demilitarised zone). A DMZ is separated from the internal LAN, so a public-facing service can be accessed without placing it directly inside the private network. [1 mark]

(c) Traffic from the internet to the DMZ web server using TCP port 80 matches the rule allowing any source to access that web server on TCP 80. The action is Allow. Port 80 is the usual port for unencrypted HTTP web traffic. [1 mark]

(d) HTTPS normally uses TCP port 443. [1 mark]

(e) A database server contains sensitive data. If it were in the DMZ, it would be more directly exposed to internet-based attacks or unauthorised access. Keeping it on the internal network means access can be restricted, for example to the web server on the required database port. [2 marks]

(f) An SSH connection from the internet to the internal LAN matches neither of the two specific allow rules. It therefore reaches the final rule that denies all remaining traffic. The action is Deny. [1 mark]

(g) Rule 3 creates a default-deny policy. The rules are checked in order, so the explicitly permitted HTTP and database traffic is allowed first. Any traffic that does not match those narrow rules is then blocked. This prevents unauthorised services, ports or destinations, such as internet SSH access to the internal LAN, from being accessed. Without this final deny rule, unmatched traffic might be permitted by default. [3 marks]

(h) The 1 bits in \(11000000_2\) represent \(128\) and \(64\).

\[11000000_2=128+64=192\]

The denary value is 192. [1 mark]

(i) Two useful firewall log entries are the source IP address and the date/time of the connection attempt. These help identify where an attack may have come from and when it occurred. Other valid information includes destination IP address, port/protocol, the matched rule, and whether the action was allow or deny. [2 marks]