CompTIA: Advanced Security Practitioner (CASP) Exam Prep

Answer: A - You should use a default deny policy to secure a firewall implementation.

Key Takeaway: On a firewall, all types of traffic and ports that are not explicitly permitted should be denied by default. A permit all policy would not serve the purpose of a firewall, which is to block unwanted traffic. A deny all policy will mean that no traffic is allowed through the firewall. A default permit policy places a huge risk on the corporate infrastructure.