Firewall

Question 1

Firewall

Answer 1

■ Common network security device that acts as a barrier to networks
■ Uses a set of rules to define permitted or denied traffic
■ Types
● Software/Hardware Based
● Virtual/Physical devices
● Host/Network Based
■ Functions
● Performs Network Address Translation (NAT) or Port Address Translation (PAT)
● Can use one public IP and many private IPs

Question 2

Types of Firewalls: Packet Filtering Firewall

Answer 2

■ Packet Filtering Firewall
● Permits or denies traffic based on packet headers
● Uses Access Control Lists (ACLs) for decision-making
● Limited by rules and may not enable two-way communication effectively

Question 3

Types of Firewalls: Stateful Firewall

Answer 3

● Inspects traffic as part of a session
● Allows incoming traffic that corresponds to outgoing requests
● Can be exploited in phishing attacks due to session-based nature
○ Combine Packet Filtering and Stateful Firewalls for good security
■ Modern firewalls often support both packet filtering and stateful capabilities

Question 4

Types of Firewalls: Next-Generation Firewall (NGFW)

Answer 4

● Conducts deep packet inspection (DPI) for detailed traffic analysis
● Operates at layers 5, 6, and 7 of the OSI model
● Can be specific to web servers (web application firewall) or for entire networks

Question 5

Access Control Lists (ACLs)

Answer 5

■ Sets of rules assigned to routers or firewalls
■ Permit or deny traffic based on IP/MAC address or port depending on device
● Switch – MAC address
● Router – IP address
● Firewall – IP address or port
■ Criteria
● Source/destination IP
● Source/destination port
● Source/destination MAC

Question 6

○ Exam Tip

Answer 6

■ Study how to read ACLs

Question 7

Unified Threat Management (UTM) System

Answer 7

■ Combines firewall, router, intrusion detection/prevention, malware solutions, and other security devices
■ Generally considered a border device with next-generation firewall capabilities
■ Available as physical, virtual, or cloud solutions