Firewalls -- Quiz

Question 1 of 6

A security engineer needs to block a specific cloud storage application used for unauthorized data exfiltration. The application runs over HTTPS (TCP/443). Other HTTPS-based business applications must continue working. Which firewall type can accomplish this, and which cannot?

A traditional firewall can block the specific application by adding a deny rule for the application's IP addresses; no NGFW is needed An NGFW can block the specific application by name while allowing other HTTPS traffic; a traditional firewall cannot distinguish applications on the same port and would have to block all TCP/443 A traditional firewall can accomplish this using deep packet inspection; NGFW provides no additional capability for this scenario Neither type can block a specific application over HTTPS because the traffic is encrypted and cannot be inspected

Question 2 of 6

A firewall ACL has three rules: (1) Allow TCP from any to any port; (2) Allow TCP/22 from 10.0.1.0/24; (3) Deny TCP/22 from any. An attacker from 203.0.113.5 successfully connects via SSH. What is the cause, and how should the rules be corrected?

The implicit deny failed; the firewall does not have an implicit deny configured and all unmatched traffic is allowed Rule 1 matches all TCP traffic (including SSH) before rule 3 can deny it; the fix is to make rule 1 specific (Allow TCP/443 or other intended ports) and place the deny SSH rule above the broad allow rule Rule 2 is matching the attacker's connection because 203.0.113.5 is within the 10.0.1.0/24 subnet; the subnet mask is too broad The SSH service on the server is not using TCP/22; it has been moved to a non-standard port that the deny rule does not cover

Question 3 of 6

An organization places its public web server and its internal HR database server on the same network segment. An attacker compromises the web server and immediately begins scanning internal systems. Which architectural change would have most directly limited the attacker's post-compromise access?

Enabling full packet capture on the web server to detect the compromise sooner Installing anti-malware software on the web server to prevent the exploit from succeeding Placing the web server in a screened subnet (DMZ) and the HR database on the internal network, with firewall rules allowing only the minimum required traffic between them Running the web server and database on separate physical hardware rather than virtual machines

Question 4 of 6

An IPS triggers on a new malware variant the same day the variant is first observed in the wild, even though no vendor signature for it yet exists. Which detection method is responsible?

Signature-based detection — the IPS vendor automatically pushes signatures for new threats within hours of discovery Anomaly-based detection — the malware's traffic behavior deviates from the established normal baseline, triggering the alert without requiring a specific signature Deep packet inspection — the NGFW reads inside the packet and identifies malicious byte sequences regardless of whether a signature exists Implicit deny — the firewall blocks all traffic that does not match an explicit allow rule, including the new malware

Question 5 of 6

A security administrator enables an IPS policy that blocks all traffic matching any rule in the "database injection" rule group. The next day, the application development team reports that their legitimate database testing tool is being blocked. What is this situation an example of, and what should the administrator do?

A false negative — the IPS should be configured to block more aggressively to prevent database injection attempts from the development team A false positive — the IPS is blocking legitimate traffic; the administrator should tune the specific rule (or create an exception for the testing tool's IP and expected traffic pattern) while keeping the broader group policy active A signature database failure — the vendor's signatures are inaccurate and the entire database injection group should be disabled An implicit deny triggering — the testing tool is generating traffic that does not match any allow rule and is being dropped by the default-deny policy

Question 6 of 6

A firewall rule base ends with: (Rule 10) Allow UDP/123 from any; and no further explicit rules. An employee tries to use FTP (TCP/21) to transfer files to an external server. What happens to the FTP traffic, and why?

The FTP traffic is allowed because no deny rule for TCP/21 exists; unmatched traffic is permitted by default The FTP traffic is denied by the implicit deny; traffic not matched by any explicit rule is automatically dropped at the bottom of the rule base The FTP traffic is allowed because Rule 10 permits UDP traffic, and FTP uses both TCP and UDP The FTP traffic triggers an IPS alert but is not blocked because the firewall ACL and IPS use separate rule bases

Matching

Match each description to the correct firewall or IPS concept.

1. A firewall that identifies the specific application in network traffic rather than just the port number, enabling per-application policy decisions at OSI Layer 7

2. A network zone positioned between the internet and the internal network that hosts publicly accessible services while preventing internet traffic from reaching internal systems

3. An IPS detection method that compares traffic against a database of known attack patterns and triggers when an exact match is found; effective against known threats but blind to novel attacks

4. A default-deny rule enforced at the bottom of a firewall rule base that drops all traffic not explicitly matched by any earlier rule

1. 2. 3. 4.

A. NGFW

B. Screened Subnet / DMZ

C. Signature-Based Detection

D. Implicit Deny

Firewalls — Quiz

Matching