NSE Firewall & Perimeter Security Flashcards

Which firewall type inspects packets at the application layer and can understand specific protocols like HTTP or FTP?

Answer: Application-layer (proxy) firewall

Application-layer proxy firewalls operate at OSI Layer 7, understanding application protocols and inspecting payload content for policy enforcement.

In a DMZ architecture, which statement BEST describes the purpose of placing a web server in the DMZ?

Answer: To expose the web server to the internet while shielding the internal network

A DMZ isolates publicly accessible servers so that a compromise does not provide direct access to the trusted internal network.

What is the primary advantage of a stateful firewall over a simple packet-filtering firewall?

Answer: It tracks the state of active connections to validate return traffic

Stateful firewalls maintain a connection table, allowing them to permit only legitimate return packets and block unsolicited inbound traffic.

Which technique do attackers use to bypass firewall rules by encapsulating malicious traffic inside an allowed protocol?

Answer: Tunneling

Tunneling encapsulates one protocol inside another (e.g., HTTP or DNS) to bypass firewall port restrictions and carry unauthorized traffic.

A next-generation firewall (NGFW) differentiates itself from a traditional stateful firewall primarily by:

Answer: Adding deep packet inspection and application awareness

NGFWs incorporate deep packet inspection, application identification, user-identity awareness, and integrated IPS capabilities beyond traditional stateful inspection.

Which firewall rule action BEST follows a deny-by-default (implicit deny) security posture?

Answer: Block all traffic unless explicitly permitted

A deny-by-default policy blocks all traffic unless a specific allow rule matches, minimizing attack surface by rejecting unlisted traffic.