This mirrors the format of a CompTIA Security+ performance-based question: read the scenario, configure each access control list entry, then submit for grading. PBQs test applied judgment, not memorization — there's no single "the" answer key phrase to recall, just whether the resulting policy actually does what the scenario requires.
You are the on-call security analyst for Meridian Clinic, a healthcare provider. The internal network segment 10.20.5.0/24 hosts the patient-records database server. A recent audit flagged the perimeter firewall as overly permissive. Configure the ACL below so that:
1. Only the application server (10.20.5.10) can reach the database on its native port.
2. Remote administration of network gear is allowed only from the internal management workstation, and only over an encrypted channel.
3. The known-malicious host flagged by threat intel must be blocked outright, regardless of what it's requesting.
4. General inbound traffic from the untrusted internet to internal hosts is denied by default.
ACL RULE SET — set ACTION for each rule (evaluated top to bottom)
Source
Destination
Port / Protocol
Action
0/0rules correct
This is a practice simulation modeled on the CompTIA PBQ format described in CompTIA's official PBQ overview — it is not an official CompTIA product and isn't pulled from the real exam item bank. Real Security+ PBQs also include drag-and-drop topology labeling, log/packet-capture analysis, and CLI command completion; this simulator covers the ACL-configuration style, one of the more common variants.