Answering the firewall questions (A4)

The firewall questions check that every in-scope device is protected by a correctly configured firewall, and that each firewall is managed safely. A good answer names the boundary devices and the software firewalls you use, says the default admin passwords were changed, confirms inbound traffic is blocked unless approved, and explains how the admin interface is protected.

Your Certification Body marks the real submission. This is Apexward's guidance from public sources.

What the questions are checking

Boundary and software firewalls (A4.1 to A4.1.2)

You are asked about firewalls between your networks and the internet, and separately about software firewalls on computers, laptops and servers. The software firewall must be on all the time, even on devices that sit behind an office firewall. For home workers using their own broadband, the device's software firewall is the control, because home routers you do not supply are out of scope. Every common desktop and server operating system, including Windows, macOS and mainstream Linux distributions, has one, so "not available" is rarely accepted.

A good answer: "Office: DrayTek Vigor router with firewall enabled. All 18 Windows 11 laptops have Microsoft Defender Firewall on for all profiles, enforced by Intune. The 2 MacBooks have the macOS firewall on, enforced by an MDM profile."

Default passwords and password quality (A4.2 to A4.4)

The default admin password must be changed on every router and firewall, including devices that ship with a unique password printed on a label. Describe how you change it and which password rule you use: MFA with a password of at least 8 characters, a deny list of common passwords with at least 8 characters, a minimum of 12 characters, or a passwordless method. Where you rely only on software firewalls, the device's own login password is the one that matters. You also need a way to change the password promptly if it may be compromised.

A good answer: "Our IT provider changed the router admin password at installation to a 20-character random password stored in our password manager. It is changed again if we suspect compromise or the vendor reports a flaw."

Managing rules (A4.5, A4.6 and A4.8)

If you have opened a port, for example for a VPN or a phone system, each rule needs a documented business case approved by an authorised person, and rules must be removed when no longer needed. You are asked whether you reviewed rules in the last 12 months and how. If you have opened nothing, say so.

A good answer: "One inbound rule: UDP 500 and 4500 to the VPN, approved by the managing director in March, recorded in our firewall register, reviewed every six months."

Inbound connections (A4.7)

This question asks whether your firewall allows unauthenticated inbound connections. The compliant answer is No. Most routers block unsolicited inbound traffic by default, but check rather than assume, including any "DMZ host" or UPnP settings.

The admin interface (A4.9 to A4.11)

You are asked whether the firewall's settings can be reached from the internet. If they cannot, or only through a VPN, answer No. If they can, you need a documented business need and protection by MFA, or by an IP allow list of a small number of trusted addresses combined with a properly managed password.

Cloud firewalls

For IaaS and PaaS, security groups and network access rules play the role of a firewall. Set them to deny by default and open only what is needed. For SaaS, the provider usually handles this.

What assessors typically query

• "Yes" to software firewalls with no product or enforcement method named.
• Router make listed in scope but no model.
• Port forwards with no business case or approver.
• Remote management enabled "for the IT company" with no MFA or allow list.
• Linux or server firewalls described as "not needed because the office firewall covers it".

Answers that fail

• Software firewall turned off on any in-scope computer.
• A default admin password still in place.
• Inbound connections allowed by default.
• An admin interface exposed to the internet without MFA or an IP allow list.

Under Danzell, any answer showing a firewall requirement is not met fails the assessment.

Checklist

1. Confirm the software firewall is on and enforced on every computer and server.
2. Log in to each router and firewall, change any default password, and turn off remote admin you do not need.
3. Write down every inbound rule with its reason and approver.
4. Check nothing is exposed that you did not intend.

Read more in firewalls and routers and network devices. The readiness checker covers these points before you start.