GCIA GCIA Firewall and Log Analysis

Question 1

What does a firewall 'implicit deny' rule do?

Accepted Answer

Denies all traffic not explicitly allowed

Answer

Allows all traffic not explicitly blocked

Answer

Logs all denied traffic without blocking

Answer

Resets TCP connections that are denied

Question 2

Which type of firewall performs deep packet inspection at the application layer?

Accepted Answer

Next-Generation Firewall (NGFW)

Answer

Packet filter firewall

Answer

Stateful inspection firewall

Answer

Circuit-level gateway

Question 3

In a firewall log, what does a 'DENY' action entry indicate?

Accepted Answer

Traffic was blocked by a matching rule

Answer

Traffic was redirected to another host

Answer

Traffic was quarantined for analysis

Answer

Traffic was rate-limited and queued

Question 4

What does a high volume of DENY log entries from a single source IP most likely suggest?

Accepted Answer

A potential port scan or attack attempt

Answer

Normal user browsing activity

Answer

A misconfigured application retrying requests

Answer

A scheduled software update process

Question 5

Which log field is most useful for correlating events across multiple security systems during an incident?

Accepted Answer

Timestamp

Answer

Protocol

Answer

Packet size

Answer

Interface name

Question 6

What security function does analyzing firewall logs primarily support?

Accepted Answer

Detecting unauthorized access attempts and policy violations

Answer

Configuring static network routes

Answer

Managing available bandwidth

Answer

Automating firmware updates