4.3 Compare Deep Packet Inspection with Packet Filtering and Stateful Firewall Operation 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security analyst is troubleshooting why a firewall is allowing a specific application that should be blocked. The firewall is configured with stateful inspection and packet filtering rules, but not DPI. The application uses a non-standard port and is not blocked by any IP rule. Which is the most likely reason the application is allowed?

   • AThe packet filtering rules are not matching the destination IP.
   • BThe stateful inspection table is not tracking the connection properly.
   • CThe firewall is configured to allow all traffic by default.
   • DThe firewall cannot identify the application because it does not inspect payload content.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a security implication of using packet filtering instead of a stateful firewall?

   • APacket filtering is more secure because it inspects the payload.
   • BPacket filtering can be bypassed by unsolicited return traffic.
   • CPacket filtering automatically blocks all encrypted traffic.
   • DPacket filtering is more secure because it tracks connection states.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is choosing a security device to enforce a policy that blocks peer-to-peer file sharing traffic, regardless of the port or protocol used. The policy must also allow all other internet traffic. Which technology is most appropriate for this requirement?

   • ADeep packet inspection, because it can identify the application signature within the payload even if the traffic uses non-standard ports.
   • BA proxy server, because it can cache content and reduce bandwidth usage.
   • CStateful firewall, because it can track the connection state and block any connection that does not match an expected pattern.
   • DPacket filtering, because it can block traffic based on destination port numbers commonly used by P2P applications.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst needs to detect a malware variant that sends a specific pattern in the payload of otherwise normal-looking HTTP requests. The firewall currently performs packet filtering only. Which technology should be added to detect this pattern?

   • APacket filtering rules that block the destination IP addresses.
   • BLogging all HTTP requests for manual review.
   • CDeep packet inspection that can match the pattern in the HTTP payload.
   • DStateful inspection that tracks the HTTP sessions.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A small company wants to replace its legacy packet-filtering firewall with a solution that can block inbound connections that are not part of an existing outbound session, while also allowing legitimate responses to return. The company has a limited budget and does not need application-level inspection. Which solution best meets the requirement?

   • AUse a proxy server to terminate all inbound connections and re-establish them internally.
   • BImplement deep packet inspection to analyze all inbound payloads for malicious content.
   • CDeploy a stateful firewall that tracks connection states and only allows return traffic for established sessions.
   • DKeep the packet-filtering firewall and add more static rules for each expected return port.
   Reveal Solution Discussion Select an answer first