4.3 Compare Deep Packet Inspection with Packet Filtering and Stateful Firewall Operation 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · easy

   A small office uses a firewall that only inspects packet headers. The administrator wants to allow inbound SSH from a specific remote office IP address while blocking all other inbound SSH. Which configuration will achieve this?

   • AAdd a rule that permits TCP port 22 from the remote office IP and a deny rule for all other inbound SSH.
   • BBlock all inbound traffic and allow all outbound traffic.
   • CConfigure deep packet inspection to identify the SSH protocol in the payload.
   • DEnable stateful inspection to track SSH sessions and allow return traffic.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team wants to detect data exfiltration attempts where sensitive files are being sent via HTTP POST requests to a cloud storage service. The team has access to a network tap and can deploy a monitoring tool. Which approach is best suited for this detection?

   • AUse a packet filter to block all HTTP POST requests to the cloud storage service.
   • BConfigure a stateful firewall to log all connections to the cloud storage service.
   • CDeploy a deep packet inspection tool that reassembles HTTP sessions and inspects the payload for file signatures or sensitive data patterns.
   • DEnable NetFlow on the router to analyze the traffic patterns and identify large transfers.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst observes that a stateful firewall is allowing inbound packets that appear to be responses to internal requests, but the internal host never initiated such requests. What is the most likely explanation for this behavior?

   • AThe firewall is performing deep packet inspection and found the packets benign, so it allowed them.
   • BThe firewall's state table may have stale or incomplete entries, causing it to incorrectly associate unsolicited packets with an existing session.
   • CThe firewall is using static packet filtering rules that allow all inbound traffic on high ports.
   • DThe firewall is configured to allow all inbound traffic regardless of state.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A network administrator wants to allow outbound web requests from internal users but block unsolicited inbound traffic. The firewall must automatically permit return traffic for established connections without requiring manual rules for each response. Which firewall operation meets this requirement?

   • AStatic packet filtering that allows all inbound traffic on port 80 and 443.
   • BStateful inspection that tracks the connection table and permits return packets that match an existing session.
   • CDeep packet inspection that examines the payload of every packet to determine if it is a response.
   • DStateless filtering that permits all TCP traffic with the ACK flag set.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A network administrator is troubleshooting a firewall issue. The firewall is configured to allow inbound TCP port 22 (SSH) to a management server. Users report that they can initiate SSH connections, but the sessions drop after a few seconds. The firewall logs show that inbound packets are being allowed, but outbound packets from the server are being dropped. The firewall is a stateful firewall. What is the most likely cause?

   • AThe firewall's state table is full, causing it to drop new connections.
   • BThe packet-filtering rules are blocking outbound traffic on port 22 because the source port is not 22.
   • CThe firewall is performing deep packet inspection and blocking SSH because it detects the protocol as insecure.
   • DThe stateful firewall is not recognizing the SSH connection as established because the outbound rule for established connections is missing or misconfigured.
   Reveal Solution Discussion Select an answer first