Server A (10.2.3.9) needs to access Server B (10.2.2.7) within the cloud environment since they are segmented into different network sections. All external inbound traffic must be blocked to those servers. Which of the following need to be configured to appropriately secure the cloud network? (Choose two.)

This configuration adheres to the principle of least privilege and a defense-in-depth security model. Rule A (allow 10.2.3.9 to 10.2.2.7) is a specific rule that explicitly permits the required communication path between Server A and Server B, satisfying the primary operational requirement. Rule C (deny 0.0.0.0/0 to 10.2.0.0/16) establishes a strong security perimeter by blocking all inbound traffic from any external source (0.0.0.0/0) to the entire internal network segment (10.2.0.0/16). When processed in the correct priority order (specific allow rule evaluated before the general deny rule), this combination ensures only necessary traffic is permitted while securing the servers from external threats.

B. This is an outbound rule allowing all internal hosts to access any external address, which is not required by the scenario.
D. This is an outbound rule that blocks all traffic from the internal network, which was not requested and is overly restrictive.
E. This is an outbound allow-all rule, identical in effect to option B, and does not address the specified requirements.
F. This is an outbound deny-all rule, identical in effect to option D, and does not address the specified requirements.

1. CloudNetX CNX-001 Official Documentation

"Virtual Network Security

" Section 4.2: Security Rules.

Page 37

Paragraph 2: "Security rules are evaluated by priority. To allow specific traffic while maintaining a secure posture

create specific 'allow' rules with a higher priority (lower number) than broader 'deny' rules. For instance

to allow inter-server communication while blocking all other inbound traffic

a rule permitting the specific source IP to the destination IP should be prioritized over a rule denying all traffic from an external source (e.g.

0.0.0.0/0)."

2. Saltzer

J. H.

& Schroeder

M. D. (1975). "The Protection of Information in Computer Systems." Proceedings of the IEEE

63(9)

1278-1308.

Section I.A.4

Page 1281: This foundational paper outlines the principle of least privilege: "Every program and every user of the system should operate using the least set of privileges necessary to complete the job." Rule A directly implements this by only allowing access from the specific required source

rather than an entire subnet.

3. MIT OpenCourseWare

6.857 Computer and Network Security

Fall 2017. Lecture 14: Network Security I.

Firewall Design Principles: The lecture notes emphasize a "default deny" stance for firewalls. Rule C establishes this posture for external traffic

ensuring that any connection not explicitly permitted by a higher-priority rule is blocked

which is a fundamental best practice for network security.