2.2 Explain the Function of Stateless Firewalls and Next-Generation Firewalls (NGFWs) CYBERSECURITY-PRACTITIONER Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security analyst is investigating a security incident where an attacker was able to send a large number of fragmented IP packets to an internal server, causing it to crash. The company uses a stateless firewall. Why was the stateless firewall unable to prevent this attack?

   • AIt cannot identify the source of the fragmented packets because the IP addresses are spoofed.
   • BIt cannot track the state of the fragmented packets to ensure they belong to a legitimate session.
   • CIt cannot reassemble fragmented packets to inspect the full payload for malicious content.
   • DIt cannot rate-limit the fragmented packets to prevent the server from being overwhelmed.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company is deploying an NGFW and wants to enforce a policy that allows employees to use Facebook for personal use, but blocks the Facebook 'like' and 'share' buttons on third-party websites. Which NGFW feature is best suited for this granular policy?

   • AUser identification, which can block specific users from using Facebook.
   • BURL filtering, which can block specific URLs like facebook.com/plugins/like.php.
   • CIntrusion prevention, which can block the 'like' button if it is associated with a known exploit.
   • DApplication identification with the ability to identify sub-applications or specific functions within an application.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A security analyst is evaluating a stateless firewall for a network that hosts a public web application. Which limitation is most significant when using a stateless firewall in this environment?

   • AIt cannot detect application-layer attacks such as SQL injection or cross-site scripting.
   • BIt is unable to block traffic on specific TCP or UDP ports.
   • CIt requires a separate intrusion prevention system (IPS) to block any malicious traffic.
   • DIt cannot filter traffic based on source or destination IP addresses.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An organization wants to enforce a policy that prevents employees from using peer-to-peer file-sharing applications, regardless of the port or protocol those applications use to communicate. Which NGFW feature is specifically designed to enforce this type of policy?

   • AIntrusion prevention, which detects and blocks known exploit signatures.
   • BStateful inspection, which tracks the state of network connections.
   • CApplication identification, which inspects traffic signatures and behavior to identify the application regardless of port.
   • DUser identification, which maps IP addresses to usernames for policy enforcement.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A network administrator is evaluating whether to replace a legacy stateless firewall with an NGFW. The network carries a mix of web traffic, email, and a custom application. The administrator is concerned about the performance impact of the NGFW. Which factor is most important to consider when assessing the performance impact?

   • AThe physical size of the NGFW appliance.
   • BThe number of users on the network.
   • CThe number of rules in the firewall's rule base.
   • DThe throughput of the NGFW when performing deep packet inspection and application identification.
   Reveal Solution Discussion Select an answer first