Firewall Types

Question 1 of 6

An organization's security policy requires that employees can view YouTube but cannot upload videos, and can read Twitter but cannot post. The current perimeter firewall allows all outbound HTTPS (port 443) traffic. Which firewall type is required to enforce these application-specific restrictions?

A. Traditional network-based firewall with additional port rules B. Next-generation firewall (NGFW) with deep packet inspection C. Web application firewall (WAF) D. Unified Threat Management (UTM) with spam filtering enabled

Question 2 of 6

A traditional network-based firewall operating at OSI Layer 4 makes forwarding decisions based on which of the following? (Select the BEST answer.)

A. Application identity and user behavior B. Source and destination IP addresses and TCP/UDP port numbers C. HTTP input parameters and query string content D. URL categories and website content classification

Question 3 of 6

A payment processing company is required by PCI DSS to protect its web-based checkout application from SQL injection and cross-site scripting attacks. Which security device specifically addresses this requirement?

A. NGFW with IPS signatures enabled B. Unified Threat Management appliance C. Traditional firewall blocking port 443 inbound D. Web Application Firewall (WAF)

Question 4 of 6

Which of the following is a defining characteristic of a Unified Threat Management (UTM) appliance compared to a dedicated Next-Generation Firewall?

A. UTMs operate exclusively at OSI Layer 7, while NGFWs operate at Layer 4 B. UTMs bundle multiple security functions in one device but typically have performance limitations when all features are enabled C. UTMs provide application-aware deep packet inspection that NGFWs cannot perform D. UTMs are designed exclusively for WAF functionality and HTTP/HTTPS inspection

Question 5 of 6

An NGFW can block a known SQL Server vulnerability exploit even when the SQL Server traffic is using a non-standard port. Which NGFW capability enables this?

A. Application identification via DPI combined with integrated IPS applying application-specific vulnerability signatures B. Port-based ACL rules that block all non-standard port traffic C. WAF input validation applied to database query parameters D. NAT translation that redirects SQL traffic to a blocked IP

Question 6 of 6

An organization deploys a security device that is positioned as a reverse proxy in front of its web server. It logs entries showing "SQL Injection in Parameter — BLOCKED" and "XSS attempt — BLOCKED" for inbound HTTP requests. Which type of device is generating these logs?

A. Next-generation firewall B. Intrusion Detection System (IDS) C. Web Application Firewall (WAF) D. Unified Threat Management appliance

Matching

1. Inspects HTTP/HTTPS input and blocks SQL injection, XSS, and path traversal attacks — deployed as a reverse proxy in front of web servers; required by PCI DSS for cardholder data environments

2. Bundles firewall, IDS/IPS, URL filtering, malware scanning, spam filtering, VPN endpoint, and bandwidth shaping into a single all-in-one appliance — designed for simplified management, primarily Layer 4 operation

3. Performs deep packet inspection at Layer 7 to identify the actual application regardless of port number — can distinguish YouTube viewing from YouTube uploading on the same port; integrates IPS and URL categorization

4. Makes forwarding decisions based on OSI Layer 3–4 headers (IP address and port number) — does not inspect packet payload; includes NAT and site-to-site VPN functionality

1. 2. 3. 4.

A. WAF

B. UTM

C. NGFW

D. Traditional Firewall

Firewall Types Quiz

Matching