Firewalls: Ports and Applications
Key Takeaways
Subdomain 4.1 names firewalls and their rules by ports and applications.
A port-based rule allows or blocks traffic by its port; an application-based rule looks at the application.
Limit each rule to the ports and applications the business needs.
Source: ISC2 CC Exam Outline effective September 1, 2026, subdomain 4.1, checked 2026-10-22.
Firewalls by Port and Application
Subdomain 4.1 names firewalls, described with the examples ports and applications. A port-based rule allows or blocks traffic to a numbered port. An application-based rule identifies traffic by the application it belongs to, which can be more precise.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomain 4.1, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
Writing the Rule
A firewall rule should allow only the ports and applications the business needs. A scenario that asks which rule to add should be answered with the narrowest rule that serves the stated need. Broad rules that allow everything are weaker answers.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 4.1: Concepts (OSI model, TCP/IP model, IPv4, IPv6, VPN)
- 4.1: Firewalls (e.g., ports, applications)
- 4.1: Wireless (e.g., Wi-Fi, Bluetooth)
- 4.1: Embedded systems (e.g., Industrial Control System), Internet of Things (IoT)
Common Traps
A common trap is confusing a model with a protocol or device. The OSI and TCP/IP models describe layers; firewalls, wireless, and IP versions are the concepts the outline names.
A team needs a web application reachable from outside. Which firewall rule is the narrowest that meets the need?
Allow the web application's port from outside, and block everything else
Allow all ports from outside so the web application can be reached by any service or any user
Allow all traffic from the internal network to the internet without any rule set or logging for the outbound flow
Disable the firewall for the web server so that every port on the host is reachable from the outside network
Sections you finish are checked off in the contents.