Module 9 CCNASEC

What is one benefit of using a next-generation firewall rather than a stateful firewall?

• reactive protection against Internet threats
• support of TCP-based packet filtering
• support of logging
• integrated use of an intrusion prevention system (IPS)

Which three layers of the OSI model include information that is commonly inspected by a stateful firewall? (Choose three.)

• Layer 1
• Layer 2
• Layer 3
• Layer 4
• Layer 5

Which statement is a characteristic of a packet filtering firewall?

• They filter fragmented packets
• They have a high impact on network performance
• They are susceptible to IP spoofing
• They examine each packet in the context of the state of a connection

Which type of firewall is supported by most routers and is the easiest to implement?

• packet filtering firewall
• next generation firewall
• stateful firewall
• application gateway firewall

Which type of traffic is usually blocked when implementing a demilitarized zone?

• traffic that is returning from the public network and traveling to the DMZ network
• traffic originating from the private network and traveling to the DMZ network
• traffic originating from the DMZ network and traveling to the private network
• traffic that is returning from the DMZ network and traveling to the private network

What are two characteristics of an application gateway firewall? (Choose two.)

• Provides an integrated intrusion prevention and detection feature
• Performs most filtering and firewall control in software
• Uses a simple policy table look-up to filter traffic based on Layer 3 and Layer 4 information
• Analyzes traffic at Layers 3, 4, 5 and 7 of the OSI model
• Uses connection information maintained in a state table and analyzes traffic at OSI Layers 3, 4, and 5

Which type of firewall generally has a low impact on network performance?

• stateless firewall
• stateful firewall
• application gateway firewall
• next generation firewall

Which type of firewall is commonly part of a router firewall and allows or blocks traffic based on Layer 3 or 4 information?

• next generation firewall
• stateful firewall
• packet filtering firewall
• proxy firewall

How does a firewall handle traffic that is originating from the DMZ network and traveling to a private network?

• Traffic is usually blocked when it is originating from the DMZ network and traveling to a private network
• Traffic is usually not filtered using firewall rules when it is originating from the DMZ network and traveling to a private network
• Traffic is usually allowed when it is originating from the DMZ network and traveling to a private network
• Traffic is allowed when it is originating from the private network, but the response traffic from the DMZ network will be blocked

Which two protocols are stateless and do not generate connection information needed to build a state table? (Choose two.)

• TCP
• HTTP
• UDP
• ICMP
• FTP