Exercise 2: Why Hardcoding Allowed Outbound Source Ports Doesn't Work — Possible Solution
====================================================================

The flaw:

Per the chapter, ephemeral source ports are "temporary, dynamically
assigned... typically somewhere in the 49152-65535 range" -- and
critically, per the chapter's own firewall section, "those are
dynamically assigned per-connection and would be impractical to
enumerate ahead of time." The junior admin's proposed rule assumes
outbound source ports are a fixed, predictable, or meaningfully
restrictable set of values -- but per the chapter's own description of
how ephemeral ports actually work, the operating system assigns a
NEW, essentially arbitrary port from that entire dynamic range every
single time a new outgoing connection is made, with no fixed pattern
an administrator could reasonably hardcode a "specific list" against.

Concretely: per the chapter's own browser-tab example, opening two
ordinary browser tabs to the same website already produces two
different, essentially unpredictable ephemeral source ports (51000 and
51001 in that example, but genuinely any available port in the dynamic
range). A single user doing completely normal, everyday things --
browsing multiple sites, checking email, running any number of
applications that make outbound connections -- would generate outbound
traffic from a constantly-changing, effectively unpredictable set of
source ports. A hardcoded allow-list of "specific" source ports would
almost certainly end up blocking large amounts of completely normal,
legitimate traffic, since the vast majority of real outbound
connections would use ephemeral ports never included on that fixed
list.

Why this doesn't actually improve security:

Per the chapter's own explicit guidance, "a firewall rule like 'allow
inbound on port 22' is specifically about which well-known, listening
ports are allowed to accept new incoming connections. It generally
doesn't need to, and shouldn't try to, restrict ephemeral/outbound
ports individually." The security-relevant question for outbound
traffic is generally about WHERE it's going and what it's connecting
to (destination IP/port, and the nature of the connection itself), not
which essentially-random ephemeral port the local OS happened to
assign it -- restricting source ports doesn't meaningfully constrain
what an attacker or malicious process could do, since they'd simply
use whatever ephemeral port the OS assigns them too, just like any
legitimate connection would.

WHY THIS WORKS AS AN ANSWER
------------------------------
This explains why ephemeral ports are fundamentally unpredictable and
therefore impractical to hardcode (using the chapter's own definition
and example), and separately explains why restricting them wouldn't
even achieve a meaningful security benefit, rather than just citing
the chapter's rule without justifying it.