Trace the first matching rule in this lab’s simplified policy model.
Describe the traffic
Before reading the rules, identify the source, destination, and service. Use the same details when comparing a test with the policy.
Find the first match
This lab evaluates rules from top to bottom and stops at the first match. A broad rule can therefore decide traffic before a more specific rule below it is reached.
Check the model’s limits
The lab is a teaching model. Real products differ in ordering, state tracking, and defaults. AWS network ACLs are one example of ordered rule evaluation; check the documentation for the system you use.
Real-world example: AWS network ACL rules
Check your reasoning.
In a first-match policy, an allow-all rule sits above a deny rule for one service. Which decides matching traffic?
Before you move on
Use these prompts to decide what to revisit.
0 of 3 reflection prompts checked
Now change something.
Predict a decision in the firewall lab, inspect the matching rule, then change the order and compare.
Test a firewall decision