4.3 Compare Deep Packet Inspection with Packet Filtering and Stateful Firewall Operation 200-201 Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A network engineer is configuring a firewall for a remote office that uses a site-to-site VPN to connect to the corporate network. The firewall must allow VPN traffic (IPsec) and also allow internal users to access the internet. The engineer wants to ensure that the firewall does not inadvertently block VPN traffic due to stateful inspection issues. Which consideration is most important?

   • AEnsure that the stateful firewall is configured to handle IPsec traffic correctly, as IPsec is not a typical TCP/UDP protocol and may require special state tracking or bypass rules.
   • BDisable the stateful firewall on the VPN interface to avoid any interference.
   • CUse packet filtering to allow all UDP traffic on port 500 and 4500, which is sufficient for IPsec.
   • DDeploy deep packet inspection to decrypt the IPsec traffic and inspect the contents.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security analyst is investigating a potential malware infection. The malware is known to use HTTP to communicate with a command-and-control server, but it uses a random User-Agent string and encodes its commands in the URL. The analyst has access to a network tap and can capture traffic. Which analysis technique is most effective for identifying this malware's traffic?

   • AUse deep packet inspection to reassemble the HTTP sessions and analyze the URL parameters and payload for patterns consistent with the malware's encoding scheme.
   • BUse a stateful firewall to log all HTTP connections and compare the source IPs.
   • CUse NetFlow to identify flows with a high packet count to the same destination.
   • DUse packet filtering to block all HTTP traffic to unknown destinations.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which statement best describes how deep packet inspection (DPI) identifies applications and content?

   • AIt uses a static list of port numbers to determine which application is in use.
   • BIt examines only the source and destination IP addresses in the packet header.
   • CIt tracks the state of TCP connections to allow return traffic.
   • DIt inspects the payload of packets, looking for signatures and protocol patterns to identify applications and content.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A network administrator is evaluating a next-generation firewall that performs deep packet inspection. The administrator is concerned about the performance impact on the network. Which statement accurately describes a trade-off of using DPI in this environment?

   • ADPI eliminates the need for stateful tracking, so it reduces memory usage.
   • BDPI uses the same processing resources as packet filtering because both only examine headers.
   • CDPI only inspects the first packet of a connection, so the performance impact is minimal.
   • DDPI can introduce latency because it must reassemble and inspect the payload of every packet, which requires more processing than header-only inspection.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security architect must choose a firewall technology for a high-throughput data center link. The requirement is to block known malicious IP addresses and ports, while also preventing a specific application that tunnels over HTTPS from being used. The solution must minimize performance impact on the link. Which approach best balances these requirements?

   • ABlock all HTTPS traffic on the link to prevent the application.
   • BUse packet filtering for IP/port blocking and deploy DPI only on a mirrored traffic copy for application detection.
   • CUse stateful inspection only, relying on connection state to block the application.
   • DDeploy DPI inline on the data center link to inspect all traffic.
   Reveal Solution Discussion Select an answer first