NSE NSE Firewall & Perimeter Security 1 — Questions and Answers
Question 1: Which firewall type inspects packets at the application layer and can understand specific protocols like HTTP or FTP?
- Packet-filtering firewall
- Stateful inspection firewall
- Application-layer (proxy) firewall (Correct answer)
- Circuit-level gateway
Correct answer: Application-layer (proxy) firewall
Application-layer proxy firewalls operate at OSI Layer 7, understanding application protocols and inspecting payload content for policy enforcement.
Question 2: In a DMZ architecture, which statement BEST describes the purpose of placing a web server in the DMZ?
- To grant the web server unrestricted access to the internal LAN
- To expose the web server to the internet while shielding the internal network (Correct answer)
- To eliminate the need for firewalls between zones
- To allow the web server to bypass stateful inspection
Correct answer: To expose the web server to the internet while shielding the internal network
A DMZ isolates publicly accessible servers so that a compromise does not provide direct access to the trusted internal network.
Question 3: What is the primary advantage of a stateful firewall over a simple packet-filtering firewall?
- It operates exclusively at Layer 2
- It tracks the state of active connections to validate return traffic (Correct answer)
- It decrypts all SSL/TLS traffic by default
- It requires no rule configuration
Correct answer: It tracks the state of active connections to validate return traffic
Stateful firewalls maintain a connection table, allowing them to permit only legitimate return packets and block unsolicited inbound traffic.
Question 4: Which technique do attackers use to bypass firewall rules by encapsulating malicious traffic inside an allowed protocol?
- ARP poisoning
- Tunneling (Correct answer)
- MAC flooding
- DNS zone transfer
Correct answer: Tunneling
Tunneling encapsulates one protocol inside another (e.g., HTTP or DNS) to bypass firewall port restrictions and carry unauthorized traffic.
Question 5: A next-generation firewall (NGFW) differentiates itself from a traditional stateful firewall primarily by:
- Filtering only UDP traffic
- Adding deep packet inspection and application awareness (Correct answer)
- Blocking all encrypted traffic
- Operating only on inbound traffic
Correct answer: Adding deep packet inspection and application awareness
NGFWs incorporate deep packet inspection, application identification, user-identity awareness, and integrated IPS capabilities beyond traditional stateful inspection.
Question 6: Which firewall rule action BEST follows a deny-by-default (implicit deny) security posture?
- Allow all traffic unless explicitly denied
- Block all traffic unless explicitly permitted (Correct answer)
- Allow inbound and block outbound
- Block UDP and allow TCP by default
Correct answer: Block all traffic unless explicitly permitted
A deny-by-default policy blocks all traffic unless a specific allow rule matches, minimizing attack surface by rejecting unlisted traffic.
NSE NSE Firewall & Perimeter Security 1
Which firewall type inspects packets at the application layer and can understand specific protocols like HTTP or FTP?