For application-aware firewalls filtering traffic between trust zones, which of the following policies should be...

Comprehensive and Detailed Explanation From Exact Extract:

In the context ofIndustrial Control Systems (ICS)andOT network security, the principle of least privilege and explicit access control is fundamental for protecting critical infrastructure assets. According to the GICSP framework, when usingapplication-aware firewallsbetween different trust zones (e.g., corporate network to OT network), any traffic that doesnot explicitly match a defined ruleshould be blocked by default. This is referred to as the“default deny” policy.

Default denymeans that unless traffic is explicitly allowed by firewall rules, it should be denied. This ensures that no unknown or unauthorized packets traverse trust boundaries, reducing the attack surface significantly.

Thedefault alertoption (A) is useful for monitoring but does not prevent unauthorized access, so it’s insufficient as a security control.

Application deny list(C) andapplication allow list(D) refer to sets of permitted or denied applications, but the firewall still needs an overarching policy to handle unmatched packets; that policy must be deny for safety.

This approach is emphasized in theICS Security Architecture and Network Segmentationdomain of GICSP, reinforcing that all unknown or unexpected network traffic should be blocked unless explicitly permitted by policy. This aligns withNIST SP 800-82 Rev 2guidance on ICS security, which GICSP incorporates.