4.3 Compare Deep Packet Inspection with Packet Filtering and Stateful Firewall Operation 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A firewall administrator needs to block all inbound traffic to a specific internal server on TCP port 3389 (RDP) from the internet, while still allowing internal users to initiate RDP connections to that server from within the LAN. Which rule set achieves this?

   • AEnable stateful inspection to track RDP sessions and allow only established connections.
   • BConfigure deep packet inspection to identify RDP traffic and block it from the internet.
   • CAdd a packet filtering rule that denies inbound traffic from the internet to the server on port 3389, and allow internal-to-internal traffic.
   • DBlock all inbound traffic on the external interface.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security architect is designing a defense-in-depth strategy for a financial institution. The strategy must include multiple layers of inspection to protect against advanced threats. The architect is considering placing a packet-filtering firewall, a stateful firewall, and a deep packet inspection device in series. Which statement best describes the security benefit of this layered approach?

   • AEach layer provides a different type of inspection, so that if one layer misses a threat, another layer may catch it, increasing overall detection coverage.
   • BThe DPI device will replace the need for the other firewalls, so the architecture can be simplified.
   • CThe stateful firewall will inspect the payload of all traffic, so the DPI device is redundant.
   • DThe packet-filtering firewall will block all malicious traffic, so the other layers are unnecessary.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   How does a stateful firewall make filtering decisions?

   • AIt tracks the state of connections and uses that information to allow or deny packets.
   • BIt inspects the payload of each packet for malicious content.
   • CIt uses a static rule set that is applied to each packet independently.
   • DIt only checks the source IP address of each packet.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which characteristic is typical of a packet filtering firewall?

   • AIt maintains a state table to track connections.
   • BIt applies the same static rule to each packet independently.
   • CIt decrypts traffic to inspect the contents.
   • DIt reassembles packets to inspect the full data stream.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A network administrator is configuring a firewall for a small office that only needs to allow web browsing and email. The administrator wants to minimize cost and complexity. Which firewall approach is most appropriate for this environment?

   • AUse a packet-filtering firewall with static rules for the required services.
   • BImplement a proxy server for all web and email traffic.
   • CUse a stateful firewall with default allow-all rules for outbound traffic.
   • DDeploy a deep packet inspection firewall to analyze all web and email content.
   Reveal Solution Discussion Select an answer first