4.3 Compare Deep Packet Inspection with Packet Filtering and Stateful Firewall Operation 200-201 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What does a packet filtering firewall primarily inspect when making a decision?

   • AThe packet headers, such as source and destination IP addresses and port numbers
   • BThe state of the TCP connection
   • CThe contents of the packet to identify the application
   • DThe application payload for malicious signatures
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is a primary advantage of a stateful firewall over a packet filtering firewall?

   • AIt can inspect the payload for application signatures.
   • BIt can automatically allow return traffic for established connections.
   • CIt is faster because it does not maintain a state table.
   • DIt does not need to examine any packet headers.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A network administrator is troubleshooting why a user cannot receive replies to outbound ICMP echo requests through a stateful firewall. The firewall has an outbound rule allowing ICMP echo requests and an inbound rule allowing ICMP echo replies. What is the most likely cause of the problem?

   • AThe inbound rule is allowing echo replies, but the user's computer is not sending the requests.
   • BThe firewall is performing deep packet inspection and blocking the echo reply because it contains a payload.
   • CThe outbound rule is blocking the echo request packets.
   • DThe stateful firewall is not tracking ICMP as a stateful protocol, so it does not automatically allow the reply packets.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company is considering deploying a deep packet inspection firewall to improve security. However, the company's network carries a large amount of encrypted traffic (TLS 1.3). The security team is concerned about the effectiveness of DPI in this environment. Which action would best address this concern?

   • AImplement SSL/TLS decryption at the firewall, using a trusted certificate installed on client devices, to allow inspection of the plaintext traffic.
   • BUse a stateful firewall instead, since it can track connections and block malicious traffic without decryption.
   • CDisable TLS 1.3 on the network to make traffic easier to inspect.
   • DRely on the DPI firewall's ability to inspect encrypted traffic without decryption by analyzing packet sizes and timing.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security analyst notices that a user's workstation is communicating with a known command-and-control server over TCP port 443. The firewall currently allows outbound HTTPS traffic based on destination port 443. The analyst needs to determine whether the traffic is actually HTTPS or some other protocol tunneled over port 443. Which approach will provide the most useful information?

   • AReview the packet headers to confirm the source and destination IP addresses and port numbers.
   • BAdd a static rule to block all outbound traffic to that specific IP address on port 443.
   • CEnable deep packet inspection on the firewall to examine the payload and identify the application protocol.
   • DCheck the firewall's state table to see if the connection is in an established state.
   Reveal Solution Discussion Select an answer first