3.2 Explain the Function of Stateful Firewalls and Next-Generation Firewalls (NGFWs) CYBERSECURITY-APPRENTICE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security administrator is reviewing firewall logs and notices that a stateful firewall is allowing inbound traffic on port 443 to a web server, even though there is no explicit inbound rule for HTTPS. The outbound rule allows web traffic from the server to the internet. Why is the inbound traffic being allowed?

   • AThe firewall is performing deep packet inspection and allowing the traffic because it is encrypted.
   • BThe firewall is tracking the outbound session and allowing the corresponding return traffic as part of that session.
   • CThe firewall is using a default permit rule for all traffic on well-known ports.
   • DThe firewall has a hidden rule that allows all traffic to the web server's IP address.
   Reveal Solution Discussion Select an answer first
2. 7foundation · medium

   What is the primary mechanism a stateful firewall uses to make filtering decisions for traffic?

   • AIt relies on a central management server to approve each packet before forwarding.
   • BIt tracks the state of active connections and uses that information along with security rules.
   • CIt examines each packet in isolation and compares it against a static list of rules.
   • DIt decrypts all traffic and inspects the application payload for malicious content.
   Reveal Solution Discussion Select an answer first
4. 8foundation · medium

   How does an NGFW identify an application that uses a non-standard port?

   • AIt requires the application to register with the firewall.
   • BIt blocks all traffic on non-standard ports.
   • CIt only trusts the port number in the packet header.
   • DIt inspects the packet payload and flow patterns to identify the application.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security architect is designing a firewall deployment for a large enterprise. The requirement is to block known malware and exploit attempts, but also to allow encrypted traffic (HTTPS) to flow without interruption. The architect is considering an NGFW with integrated threat prevention. What is the primary challenge they must address?

   • AThe NGFW requires a separate antivirus solution to block malware.
   • BThe NGFW cannot inspect encrypted traffic without decrypting it, which may require a decryption policy and certificate management.
   • CThe NGFW cannot block malware that uses non-standard ports.
   • DThe NGFW will block all HTTPS traffic if it cannot identify the application.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is migrating from a traditional stateful firewall to an NGFW. The security team wants to enforce policies based on user identity and application, but they are concerned about the complexity of managing the new firewall. What is the best way to ease the transition?

   • AUse a single rule to allow all traffic and then gradually add restrictions.
   • BDisable application and user identification features initially to reduce complexity.
   • CMigrate all existing rules from the traditional firewall to the NGFW without changes.
   • DDeploy the NGFW in a passive monitoring mode to learn traffic patterns before enforcing policies.
   Reveal Solution Discussion Select an answer first