Which of the following should normally be blocked through a firewall?

Simple Network Management Protocol (SNMP) is used for managing and monitoring network devices. Exposing SNMP to the internet is a significant security vulnerability, as it can reveal sensitive information about a network's infrastructure, device configurations, and operational status. Attackers can leverage this information for detailed reconnaissance. Security best practices strongly recommend that access to management protocols like SNMP be restricted to trusted, internal management networks and that all SNMP traffic from the public internet be blocked at the perimeter firewall.

B. SMTP: Simple Mail Transfer Protocol is essential for sending and receiving email between servers. Blocking it would prevent an organization from receiving emails from the internet.
C. NTP: Network Time Protocol is used to synchronize system clocks. Accurate time is critical for logging, forensics, and cryptographic functions. Organizations often need to sync with external time sources.
D. POP3: Post Office Protocol version 3 is used by email clients to retrieve mail. While less common now, blocking it would prevent users who rely on it from accessing their email.

1. Cybersecurity and Infrastructure Security Agency (CISA). (2017). Securing Network Infrastructure Devices. CISA. In the section "Restrict and Secure Management Interfaces," the guide explicitly states, "Block access to the management interface from the internet. Protocols such as HTTP, HTTPS, SNMP, SSH, and Telnet should not be accessible from the internet." This directly supports blocking SNMP at the firewall.

2. National Institute of Standards and Technology (NIST). (2008). NIST Special Publication 800-123: Guide to General Server Security. Section 5.6, "Secure Remote Administration," page 5-11. The document advises that "all remote administration should be performed over a secure channel" and recommends restricting access to management networks, which implicitly supports blocking general internet access to management protocols like SNMP.

3. University of California, Berkeley. Security Best Practices: Network. Berkeley Information Security Office. The guidelines recommend to "Block all unneeded ports at the firewall" and specifically list SNMP (ports 161/162) as a protocol that is "commonly scanned for" and should be firewalled from the Internet unless there is a specific business need.