4.3 Compare Deep Packet Inspection with Packet Filtering and Stateful Firewall Operation 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company is deploying a new firewall and must choose between a stateful firewall and a deep packet inspection firewall. The company's main concern is preventing data exfiltration of sensitive documents over encrypted HTTPS connections. The company also wants to minimize the performance impact on users. Which solution is most appropriate?

   • AUse a packet-filtering firewall to block outbound traffic on port 443 to non-approved IP addresses.
   • BImplement a stateful firewall with application-level rules that block file-sharing applications.
   • CDeploy a stateful firewall that blocks all outbound HTTPS traffic to unknown destinations.
   • DDeploy a deep packet inspection firewall with SSL/TLS decryption and content filtering to inspect the decrypted payloads for sensitive data patterns.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a key capability of deep packet inspection (DPI) that distinguishes it from standard packet filtering?

   • AIt can identify the application even when it uses non-standard ports.
   • BIt can block traffic based on the source MAC address.
   • CIt automatically encrypts all traffic that passes through the firewall.
   • DIt only inspects the TCP flags in the packet header.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security architect must design a firewall solution for a DMZ hosting a public web server. The requirements are: allow inbound HTTPS to the web server, block known malicious IP addresses, and detect SQL injection attempts in the HTTP requests. The solution must also maintain a record of established connections for auditing. Which combination of technologies best satisfies all requirements?

   • APacket filtering only, with rules for HTTPS and malicious IPs.
   • BStateful firewall for connection tracking, packet filtering for IP blocking, and DPI for SQL injection detection.
   • CDPI only, with rules for HTTPS and IP blocking.
   • DStateful firewall only, with rules for HTTPS and IP blocking.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An organization wants to prevent employees from using a specific social media application that runs over HTTPS. The firewall must identify the application even though the payload is encrypted. Which technology is most appropriate?

   • ADeep packet inspection with SSL/TLS decryption and application identification.
   • BBlock all HTTPS traffic to the internet.
   • CPacket filtering based on the destination IP addresses of the social media service.
   • DStateful inspection that tracks the HTTPS sessions.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which statement correctly compares deep packet inspection (DPI) with packet filtering?

   • ADPI is faster than packet filtering because it inspects less data.
   • BDPI can identify applications and content, while packet filtering only inspects headers.
   • CPacket filtering provides deeper inspection than DPI.
   • DBoth DPI and packet filtering track connection states.
   Reveal Solution Discussion Select an answer first