For Teachers · Back to the Module · Print with your browser's Print command.

P3 Teacher Answer Key: Network Exposure and Firewalls

Teacher Answer Key (about 20 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: F1, F3

Learning Objectives

• [ ] Explain the difference between binding to 127.0.0.1 and to 0.0.0.0.
• [ ] Explain why exposed databases and caches cause mass breaches.
• [ ] Explain default-deny firewall policy.

Key Terms

Write each definition in your own words.

• Attack Surface: All the points where an attacker could try to interact with a system, such as listening ports, web pages and accounts.
• Port: A number that identifies a network service on a machine, such as 22 for SSH or 443 for HTTPS.
• Loopback: The network interface that only reaches the same machine: 127.0.0.0/8 for IPv4 and ::1 for IPv6.
• Firewall: Software or hardware that allows or blocks network traffic according to rules.
• Default Deny: A firewall or access policy that blocks everything except what is explicitly allowed.
• Cleartext: Data sent or stored without encryption, readable by anyone who can see it.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only NET- --out p3 and open the NET-LSN-001 evidence.
2. Compare the vulnerable lab (MySQL and Redis on 0.0.0.0) with the hardened lab (127.0.0.1).
3. On your own server: ss -tulpn and classify each socket as local only or network reachable.

Self-Check Questions

1. A service bound to 127.0.0.1 is reachable from:

• [ ] a) The whole internet
• [x] b) Only the same machine
• [ ] c) Only the local network
• [ ] d) Any machine the firewall allows
• Answer: b. Loopback addresses never leave the machine, whatever the firewall says.

1. What does a default-deny firewall policy do?

• [x] a) Blocks everything not explicitly allowed
• [ ] b) Allows everything not explicitly blocked
• [ ] c) Logs traffic only
• [ ] d) Blocks only known bad addresses
• Answer: a. Default deny allows only the ports you intend and drops everything else.

1. Why is Telnet considered insecure?

• [ ] a) It is slow
• [x] b) It sends credentials unencrypted
• [ ] c) It only works on Windows
• [ ] d) It cannot be firewalled
• Answer: b. Anyone on the network path can read the password.

1. A service is bound to 0.0.0.0 and no firewall is running. Who can reach it?

• [ ] a) Only the same machine
• [x] b) Any network that can route to the server
• [ ] c) Only IPv6 clients
• [ ] d) Only clients that know a password
• Answer: b. 0.0.0.0 means every IPv4 address on the machine. Without a firewall, anyone who can route to the server can connect.

1. How does OpenVAPT find listening services?

• [ ] a) It port scans the network
• [x] b) It reads the kernel's own socket tables
• [ ] c) It asks each service for its version
• [ ] d) It reads the firewall rules only
• Answer: b. Reading the kernel's socket tables shows every listener without sending any traffic.

1. What must you do before enabling a default-deny firewall on a remote server?

• [x] a) Allow SSH
• [ ] b) Stop the web server
• [ ] c) Disable IPv6
• [ ] d) Reboot the server
• Answer: a. If SSH is not allowed first, the new policy can lock you out of the server.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy: https://csrc.nist.gov/pubs/sp/800/41/r1/final
• OWASP Database Security Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Database_Security_Cheat_Sheet.html

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.