4.5 Firewalls

Question 1

What is a network-based firewall?

Answer 1

An appliance that sits inline in your network and makes decisions about whether traffic should be allowed or disallowed through the firewall.

Question 2

What are the two main types of firewalls mentioned?

Answer 2

• Traditional firewall
• Next-generation firewall (NGFW)

Question 3

What additional services can a firewall provide beyond security?

Answer 3

• VPN endpoints
• VPN concentrators
• Routing functions

Question 4

What does a next-generation firewall (NGFW) do?

Answer 4

Analyzes traffic and recognizes specific applications to make decisions about allowing or disallowing traffic.

Question 5

True or False: Traditional firewalls only make decisions based on port numbers.

Answer 5

True

Question 6

What is an application layer gateway?

Answer 6

Another term for a next-generation firewall.

Question 7

What is packet capturing?

Answer 7

The process of intercepting and logging traffic that passes through the firewall for analysis.

Question 8

Fill in the blank: A next-generation firewall can allow or disallow _______ server traffic.

Answer 8

web

Question 9

What does the term ‘implicit deny’ refer to in firewall rules?

Answer 9

All traffic that does not match any specific rule is automatically denied.

Question 10

What is an Access Control List (ACL)?

Answer 10

A list of rules that determine what traffic is allowed or denied through a firewall.

Question 11

What is the purpose of an Intrusion Prevention System (IPS)?

Answer 11

To monitor traffic in real time and recognize malicious software using signatures.

Question 12

How does an IPS identify threats without specific signatures?

Answer 12

By looking for anomalies that indicate a potential intrusion.

Question 13

What type of traffic does the Conficker worm signature target?

Answer 13

Specific types of traffic associated with the Conficker worm.

Question 14

What are some common protocols mentioned for firewall rules?

Answer 14

• TCP
• UDP
• ICMP

Question 15

Fill in the blank: Microsoft Remote Desktop Protocol uses TCP port _______.

Answer 15

3389

Question 16

What is the function of network address translation in firewalls?

Answer 16

To modify the IP address information in the IP header of packets while they are in transit.

Question 17

What is the significance of placing specific rules at the top of a firewall rule base?

Answer 17

To quickly recognize and apply the most specific rules.

Question 18

What happens if a firewall rule allows traffic from any remote IP address to a local port number of 80?

Answer 18

HTTP traffic is allowed.

Question 19

What type of traffic is allowed through port 53?

Answer 19

DNS traffic.

Question 20

What is ICMP commonly associated with?

Answer 20

Ping operations.

Question 21

Fill in the blank: An IPS can block traffic based on _______ vulnerabilities.

Answer 21

known

Question 22

What is a common issue with IPS rules?

Answer 22

False positives.

Question 23

What is a screened subnet?

Answer 23

A subnet that holds services and devices accessible by individuals on the internet, separate from sensitive data.

Question 24

What is the primary role of a firewall in a network?

Answer 24

To control the ingress and egress of traffic between the internal network and the internet.

Question 25

True or False: The next-generation firewall does not require packet analysis.

Answer 25

False

Question 26

What is one challenge of having many rules in an IPS?

Answer 26

Managing false positives while maintaining security.

Question 27

What does the term 'signature' refer to in the context of an IPS?

Answer 27

A predefined pattern used to identify specific types of malicious traffic.

Question 28

What is a common issue found in an IPS?

Answer 28

False positives ## Footnote False positives occur when legitimate traffic is mistakenly identified as malicious.

Question 29

What can be customized in an IPS to improve security?

Answer 29

Rules ## Footnote Customizing rules helps balance security and the identification of false positives.

Question 30

What type of rules might you find in an IPS?

Answer 30

Rules based on malware ## Footnote These rules often involve specific port numbers and malware names.

Question 31

What is an example of a protocol that may have specific rules in an IPS?

Answer 31

FTP protocol ## Footnote The FTP protocol can have rules to identify worms during the login process.

Question 32

How can an IPS be configured regarding worms in the FTP login process?

Answer 32

To identify and block them ## Footnote This configuration prevents the worm from entering the network.