3.2 Explain the Function of Stateful Firewalls and Next-Generation Firewalls (NGFWs) CYBERSECURITY-APPRENTICE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company currently uses a traditional stateful firewall that filters traffic based on ports and IP addresses. They are experiencing security issues because employees are using applications that bypass the firewall by using non-standard ports. What is the primary advantage of upgrading to an NGFW?

   • AIt can filter traffic based on MAC addresses, providing stronger security.
   • BIt can identify and control applications regardless of the port they use.
   • CIt can block all traffic on non-standard ports automatically.
   • DIt can track connection state more accurately than a traditional firewall.
   Reveal Solution Discussion Select an answer first
2. 27foundation · medium

   What is the primary role of the state table in a stateful firewall?

   • ATo store the firewall's configuration and security policies.
   • BTo record information about active connections so return traffic can be allowed.
   • CTo log all traffic for compliance and auditing purposes.
   • DTo cache DNS lookups for faster name resolution.
   Reveal Solution Discussion Select an answer first
4. 28foundation · medium

   What is a key advantage of stateful inspection over stateless packet filtering?

   • AIt automatically allows return traffic for established connections.
   • BIt examines the full content of every packet for malware.
   • CIt can block traffic based on the application being used.
   • DIt encrypts all traffic passing through the firewall.
   Reveal Solution Discussion Select an answer first
5. 29foundation · medium

   What is a primary difference between a traditional stateful firewall and an NGFW?

   • ATraditional firewalls are software-based, while NGFWs are hardware-based.
   • BTraditional firewalls only block inbound traffic, while NGFWs only block outbound traffic.
   • CTraditional firewalls filter based on ports and IPs, while NGFWs also consider applications and users.
   • DTraditional firewalls cannot perform NAT, while NGFWs can.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security administrator is troubleshooting a stateful firewall that is dropping return traffic for a DNS query. The firewall has an outbound rule that allows UDP 53 from internal clients to the DNS server. The DNS server responds from a different source port (e.g., 5353) than the destination port of the query. Why is the return traffic being dropped?

   • AThe firewall is configured to allow only TCP traffic, so it drops all UDP traffic.
   • BThe firewall is not tracking UDP sessions because UDP is connectionless.
   • CThe firewall is blocking all traffic on UDP port 5353 because it is not a well-known port.
   • DThe firewall is matching the return traffic to the session based on the destination port, which is the original source port, but the response is coming from a different source port.
   Reveal Solution Discussion Select an answer first