During a test, when an external firewall unexpectedly allows an internal connection after a DoS event, what is the most likely explanation?

• A. The firewall failed-open
• B. The firewall failed-closed
• C. The firewall ACL has been purged
• D. The firewall failed-bypass

Answer: (A)

When a firewall fails, it can enter different failure states. Failing open means the device stops enforcing its rules and lets traffic through, often to keep the network reachable even when something goes wrong. If an external firewall suddenly allows an internal connection after a DoS event, that pattern fits a fail-open condition: the firewall isn’t blocking as it should, so traffic that should be denied is allowed.

A fail-closed scenario would block traffic, not allow it, so that wouldn’t match the observed behavior. Purging an ACL would be an administrative action that changes rules, but it isn’t typically triggered by a DoS event and wouldn’t spontaneously explain traffic being allowed in the moment. A failed-bypass implies traffic takes a path that circumvents the firewall, which is a different failure mode and not the most straightforward explanation for the described situation.

So, the most plausible explanation is that the firewall failed-open during the DoS event, resulting in the unexpected access.