2.2 Explain the Function of Stateless Firewalls and Next-Generation Firewalls (NGFWs) CYBERSECURITY-PRACTITIONER Practice Questions (Page 5)

Questions 21–22

1. 21application · medium

   A company's security team discovers that malware is exfiltrating data by embedding it in HTTP requests to a legitimate cloud storage service. The current security infrastructure is a stateless firewall that only filters by IP address and port. Which additional capability would most directly address this threat?

   • AApplication-level inspection that can identify and control the specific cloud storage application and its traffic patterns.
   • BA stateful firewall that tracks the TCP handshake and ensures all packets belong to an established session.
   • CA network tap that captures all traffic for offline forensic analysis.
   • DA more comprehensive set of static rules that block all traffic to the specific cloud storage IP addresses.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst is troubleshooting a network where a stateless firewall is the only security device. The analyst notices that a large number of packets are being sent to the firewall with the SYN flag set, but no corresponding ACK packets are seen. This is a classic sign of a SYN flood attack. Why is the stateless firewall unable to effectively mitigate this attack?

   • AIt cannot inspect the payload of the SYN packets to determine if they contain malicious code.
   • BIt cannot rate-limit SYN packets because it does not have a rate-limiting feature.
   • CIt cannot identify the source IP addresses of the SYN packets because they are spoofed.
   • DIt cannot distinguish between a legitimate new connection and a flood of SYN packets because it does not track connection state.
   Reveal Solution Discussion Select an answer first