Which ACL rule is generally more secure?

• A. Permit access to all internal webservers
• B. Deny all external access
• C. Permit access to a single internal webserver
• D. Apply no ACLs

Answer: (C)

Limiting what is reachable through an ACL is about reducing the attack surface by giving the smallest amount of access required. Permitting access to a single internal webserver achieves that: it concentrates exposure to just one host, making it easier to enforce strict controls (such as allowing only specific protocols, ports, and trusted IPs) and to monitor and defend that server. If an attacker manages to compromise a system, the impact is contained to that one server rather than all internal webservers, and you can apply tighter security measures around it.

Allowing access to all internal webservers broadens the potential targets and complicates containment and monitoring. Denying all external access sounds very secure in theory, but it can render legitimate services unusable and is not practical for typical operations. Not applying any ACLs removes protection altogether, increasing risk.

So, permitting access to a single internal webserver best balances security with functionality and aligns with restricting access to what’s truly necessary.