Which principle should govern connections entering the network?

• A. Allow only established connections
• B. Permit all connections from trusted partners
• C. Block all inbound connections
• D. Remove all firewall rules

Answer: (A)

Think of inbound traffic through the lens of stateful filtering: you only allow traffic that is part of an already established connection. When an internal host initiates a connection to the outside, the return packets are considered part of that established session and are allowed. Unsolicited inbound attempts—new connections started from outside—are blocked unless there is an explicit rule. This approach minimizes exposure to external attack attempts and aligns with a deny-by-default stance common in PCI guidance.

That’s why allowing only established connections is the best choice. Permitting all connections from trusted partners is still risky because a partner could be compromised or misconfigured. Blocking all inbound connections would prevent legitimate services from functioning. Removing firewall rules would remove essential protections.