4.3 Compare Deep Packet Inspection with Packet Filtering and Stateful Firewall Operation 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A firewall administrator notices that a stateful firewall is allowing inbound TCP packets that do not match any existing connection in the state table. The packets have the ACK flag set. What is the most likely cause and the best corrective action?

   • AThe firewall is performing deep packet inspection and misidentifying the packets; disable DPI.
   • BThe firewall's state table is full, so it is treating all packets as new connections; increase the state table size.
   • CThe remote server is sending packets with a spoofed ACK flag; configure the firewall to ignore the ACK flag.
   • DThe firewall is configured with a stateless rule that permits TCP packets with the ACK flag set; remove or refine that rule to rely on stateful tracking.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A network administrator is configuring a firewall for a small business that uses a legacy application that sends data over a fixed UDP port. The application requires that the firewall allow inbound UDP packets to the server only if the server recently sent an outbound packet to the same client. The administrator wants to implement this with minimal configuration. Which approach is most appropriate?

   • AUse a packet-filtering firewall with a static rule to allow all inbound UDP traffic on that port.
   • BUse deep packet inspection to validate that the UDP payload matches an expected format.
   • CUse a stateful firewall that tracks UDP flows and allows inbound packets only if they match an existing outbound flow.
   • DConfigure the firewall to allow inbound UDP traffic only from the IP addresses of known clients.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security engineer is designing a firewall policy for a DMZ that hosts a public web server. The policy must allow inbound HTTPS traffic to the web server and allow the web server to initiate outbound connections to a database server on an internal network. The engineer wants to minimize the number of rules and ensure that only legitimate responses to inbound HTTPS requests are allowed back to external clients. Which firewall approach is most appropriate?

   • AUse a packet-filtering firewall with static rules for inbound HTTPS and outbound responses on high ports.
   • BPlace the web server on the internal network and use a reverse proxy to forward HTTPS traffic.
   • CUse a stateful firewall with an inbound rule allowing HTTPS to the web server and an outbound rule allowing established connections to return.
   • DUse deep packet inspection to validate that all inbound HTTPS traffic contains valid TLS handshakes.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A network administrator needs to block all traffic from a specific source IP address on a firewall that only supports packet filtering. The firewall should still allow all other traffic. Which rule should be configured?

   • AConfigure deep packet inspection to block the source IP.
   • BEnable stateful inspection to block the source IP.
   • CAdd a deny rule for the source IP address, placed before any allow rules.
   • DAdd an allow rule for all traffic, then a deny rule for the source IP.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A network administrator wants to allow internal users to access external websites, but block all inbound connection attempts from the internet. The firewall must automatically permit responses to the internal users' requests. Which firewall configuration is most appropriate?

   • AAllow all inbound traffic on ports 80 and 443.
   • BConfigure packet filtering to allow all outbound traffic and deny all inbound traffic.
   • CEnable stateful inspection with a rule that allows outbound web traffic and denies all inbound new connections.
   • DUse deep packet inspection to identify web traffic and allow it inbound.
   Reveal Solution Discussion Select an answer first