NSE Firewall & Perimeter Security Flashcards

What is the purpose of egress filtering on a perimeter firewall?

Answer: To restrict unauthorized outbound traffic leaving the internal network

Egress filtering prevents compromised internal hosts from exfiltrating data or communicating with command-and-control servers on the internet.

Which technology is used to allow remote users to securely traverse a perimeter firewall and access internal resources?

Answer: VPN (Virtual Private Network)

VPNs create an encrypted tunnel through the perimeter firewall, allowing authenticated remote users to securely access internal network resources.

In firewall policy, what does the term 'rule shadowing' mean?

Answer: A rule that can never be matched because a preceding rule already matches that traffic

Rule shadowing occurs when a broader rule earlier in the policy matches all traffic intended for a more specific rule, making the specific rule unreachable.

Which attack specifically targets the firewall's connection state table to exhaust its resources?

Answer: SYN flood attack

A SYN flood sends large numbers of half-open TCP connection requests to fill the stateful firewall's connection table, causing denial of service.

What is the role of a Web Application Firewall (WAF) compared to a network perimeter firewall?

Answer: A WAF specifically inspects HTTP/HTTPS traffic to protect web applications from Layer 7 attacks

A WAF operates at the application layer to detect and block web-specific attacks such as SQL injection, XSS, and CSRF targeting web applications.

Which of the following is a recommended best practice when managing firewall rule bases over time?

Answer: Regularly audit and remove unused or redundant rules to reduce attack surface

Periodic rule base audits identify and remove stale, shadowed, or unnecessary rules, reducing complexity and potential security gaps.