2.2 Explain the Function of Stateless Firewalls and Next-Generation Firewalls (NGFWs) CYBERSECURITY-PRACTITIONER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A network administrator is choosing between a stateless firewall and an NGFW for a high-throughput data center backbone. The primary requirement is to filter traffic at line rate with minimal latency, and the traffic is well-defined and uses only a few standard ports. The security team is concerned about cost. Which solution best meets the stated requirements?

   • AAn NGFW, because it provides application-level inspection that is essential for any network.
   • BAn NGFW with hardware acceleration, because it can achieve line-rate performance and provide security.
   • CA stateless firewall, because it performs simple header-based filtering with minimal processing overhead.
   • DA stateless firewall with an IPS module, because it combines performance with security.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A network architect is designing a security solution for a large enterprise. The network has a core backbone that carries high-volume, low-risk traffic (e.g., database replication) and edge segments that carry user traffic to the internet. The architect wants to optimize both security and performance. Which deployment strategy is most effective?

   • ADeploy NGFWs at the edge for user traffic and stateless firewalls on the core backbone for high-throughput filtering.
   • BDeploy stateless firewalls everywhere to ensure maximum performance.
   • CDeploy NGFWs everywhere to ensure maximum security across the entire network.
   • DDeploy a single NGFW at the internet gateway and rely on it to protect all segments.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A network engineer is configuring a stateless firewall to allow inbound HTTP traffic to a web server. The firewall is using a standard access control list (ACL). Which action must the engineer also take to ensure the web server can respond to clients?

   • AEnable stateful inspection on the firewall to allow the return traffic automatically.
   • BConfigure the web server to use a non-standard port so the firewall can track the session.
   • CAdd a rule to permit the return traffic from the web server to the clients.
   • DPlace the web server in a demilitarized zone (DMZ) to avoid the need for a return rule.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which attack is a stateless firewall most likely to miss because it does not track connection state?

   • AAn IP spoofing attack where the source address is forged.
   • BA TCP SYN flood that sends many half-open connection requests.
   • CA port scan that attempts to connect to multiple ports on a host.
   • DA DNS amplification attack that uses spoofed source addresses.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is deploying an NGFW and wants to ensure that employees can access the internet but cannot use certain applications like BitTorrent or other peer-to-peer file-sharing tools. The company also wants to log all attempts to use these applications. Which NGFW feature is most important for this requirement?

   • AURL filtering, which can block access to torrent websites.
   • BApplication identification, which can identify BitTorrent and other P2P applications regardless of the port or protocol.
   • CIntrusion prevention, which can block known P2P exploits.
   • DUser identification, which can identify the user attempting to use BitTorrent.
   Reveal Solution Discussion Select an answer first