Module 9

Question 1

A ___ is a system, or group of systems, that enforces an access control policy between networks.

Answer 1

firewall

Question 2

All firewalls share some common properties:

Answer 2

Firewalls are resistant to network attacks.

Firewalls are the only transit point between internal corporate networks and external networks because all traffic flows through the firewall.

Firewalls enforce the access control policy.

Question 3

There are several benefits of using a firewall in a network:

Answer 3

They prevent the exposure of sensitive hosts, resources, and applications to untrusted users.

They sanitize protocol flow, which prevents the exploitation of protocol flaws.

They block malicious data from servers and clients.

They reduce security management complexity by off-loading most of the network access control to a few firewalls in the network.

Question 4

Firewalls also have some limitations:

Answer 4

A misconfigured firewall can have serious consequences for the network, such as becoming a single point of failure.

The data from many applications cannot be passed over firewalls securely.

Users might proactively search for ways around the firewall to receive blocked material, which exposes the network to potential attack.

Network performance can slow down.

Unauthorized traffic can be tunneled or hidden as legitimate traffic through the firewall.

Question 5

Types of Firewall

Answer 5

Packet Filtering (Stateless) Firewall

Stateful Firewall

Application Gateway Firewall

Next Generation Firewall

Question 6

Other methods of implementing firewalls include:

Answer 6

Host-based (server and personal) firewall - A PC or server with firewall software running on it.

Transparent firewall - Filters IP traffic between a pair of bridged interfaces.

Hybrid firewall - A combination of the various firewall types. For example, an application inspection firewall combines a stateful firewall with an application gateway firewall.

Question 7

An ____ filters information at Layers 3, 4, 5, and 7 of the OSI reference model.

Answer 7

application gateway firewall

Question 8

A _____ is a combination of the various firewall types.

Answer 8

hybrid firewall

Question 9

A _____ is part of a router firewall that permits or denies traffic based on Layer 3 and Layer 4 information.

Answer 9

packet filtering firewall

Question 10

_____ is a PC or server with firewall software running on it.

Answer 10

Host-based firewalls

Question 11

A _____ filters IP traffic between a pair of bridged interfaces.

Answer 11

transparent firewall

Question 12

There are several advantages of using a packet filtering firewall:

Answer 12

Packet filters implement simple permit or deny rule sets.

Packet filters have a low impact on network performance.

Packet filters are easy to implement, and are supported by most routers.

Packet filters provide an initial degree of security at the network layer.

Packet filters perform almost all the tasks of a high-end firewall at a much lower cost.

Question 13

There are several disadvantages of using a packet filtering firewall:

Answer 13

Packet filters are susceptible to IP spoofing. Threat actors can send arbitrary packets that meet ACL criteria and pass through the filter.

Packet filters do not reliably filter fragmented packets. Because fragmented IP packets carry the TCP header in the first fragment and packet filters filter on TCP header information, all fragments after the first fragment are passed unconditionally. Decisions to use packet filters assume that the filter of the first fragment accurately enforces the policy.

Packet filters use complex ACLs, which can be difficult to implement and maintain.

Packet filters cannot dynamically filter certain services. For example, sessions that use dynamic port negotiations are difficult to filter without opening access to a whole range of ports.

Question 14

There are several benefits to using a stateful firewall in a network:

Answer 14

Stateful firewalls are often used as a primary means of defense by filtering unwanted, unnecessary, or undesirable traffic.

Stateful firewalls strengthen packet filtering by providing more stringent control over security.

Stateful firewalls improve performance over packet filters or proxy servers.

Stateful firewalls defend against spoofing and DoS attacks by determining whether packets belong to an existing connection or are from an unauthorized source.

Stateful firewalls provide more log information than a packet filtering firewall.

Question 15

Stateful firewalls also present some limitations:

Answer 15

Stateful firewalls cannot prevent application layer attacks because they do not examine the actual contents of the HTTP connection.

Not all protocols are stateful. For example, UDP and ICMP do not generate connection information for a state table, and, therefore, do not garner as much support for filtering.

It is difficult to track connections that use dynamic port negotiation. Some applications open multiple connections. This requires a whole new range of ports that must be opened to allow this second connection.

Stateful firewalls do not support user authentication.

Question 16

Benefits

Answer 16

Primary means of defense

Strong packet filtering

Improved performance over packet filters

Defends against spoofing and DoS attacks

Richer data log

Question 17

Limitations

Answer 17

No Application Layer inspection

Limited tracking of stateless protocols

Difficult to defend against dynamic port negotiation

No authentication support

Question 18

Common Security Architectures / Common Firewall Designs

Answer 18

Private and Public

Demilitarized Zone

Zone-Based Policy Firewalls

Question 19

Considerations for Layered Network Defense

Answer 19

Network Core security - Protects against malicious software and traffic anomalies, enforces network policies, and ensures survivability
Perimeter security - Secures boundaries between zones
Communications security - Provides information assurance
Endpoint security - Provides identity and device security policy compliance

Question 20

A ____ typically has one inside interface, one outside interface, and one DMZ interface.

Answer 20

demilitarized firewall design

Question 21

In a ____, security measures are taken at the network core, perimeter, endpoints, and other communication security points.

Answer 21

layered network defense

Question 22

The public internet is considered _____. Internal networks are generally considered to be _____; however additional security may be required to protect them from threats. In a ZPF, traffic that travels within zones is generally considered as trusted.

Answer 22

untrusted ; trusted

Question 23

____ groups interfaces into zones that have similar functions or features.

Answer 23

ZPF

Question 24

What is one benefit of using a next-generation firewall rather than a stateful firewall?

Answer 24

Stateful firewalls and next-generation firewalls provide better log information than a packet filtering firewall, both defend against spoofing, and both filter unwanted traffic. Next-generation firewalls provide the following benefits over stateful firewalls:

Granularity control within application​s
Website and application traffic filtering based on site reputation
Proactive rather than reactive protection from Internet threats
Enforcement of security policies based on multiple criteria including user, device, role, application, and threat profile
Improved performance with NAT, VPN, and stateful inspections
Integrated IPS

Question 24

_____ to limit access to endpoints. _____ to firewall devices to prevent tampering unauthorized access to configuration ports.

Answer 24

Disable unnecessary network services ; Strictly control physical access

Question 25

Which three layers of the OSI model include information that is commonly inspected by a stateful firewall? (Choose three.)

Answer 25

A stateful firewall provides filtering at the network layer, but also analyzes traffic at OSI Layer 4 and Layer 5.

Question 26

Which type of firewall is supported by most routers and is the easiest to implement?

Answer 26

A packet filtering firewall uses a simple policy table look-up that filters traffic based on specific criteria and is considered the easiest firewall to implement.

Question 27

Which statement is a characteristic of a packet filtering firewall?

Answer 27

Packet filtering firewalls have a low impact on network performance. They are stateless, examining each packet individually and they do not filter fragmented packets well.

Question 28

Which type of firewall generally has a low impact on network performance?

Answer 28

A stateless firewall uses a simple policy table look-up that filters traffic based on specific criteria and causes minimal impact on network performance.

Question 28

What are two characteristics of an application gateway firewall? (Choose two.)

Question 28

Which type of traffic is usually blocked when implementing a demilitarized zone?

Answer 28

A firewall will usually block traffic that is originating from the DMZ network and traveling to the private network. If traffic originated from the private network and the DMZ is sending returning traffic to the private network, then it will be allowed.

Question 29

Which type of firewall is commonly part of a router firewall and allows or blocks traffic based on Layer 3 or 4 information?

Answer 29

A packet filtering firewall uses a simple policy table look-up that filters traffic based on specific criteria. These firewalls are usually part of a router firewall. They permit or deny traffic based on Layer 3 and Layer 4 information.

Question 30

How does a firewall handle traffic that is originating from the DMZ network and traveling to a private network?

Answer 30

A firewall will usually block traffic that is originating from the DMZ network and traveling to the private network. If traffic originated from the private network and the DMZ is sending returning traffic to the private network, then it will be allowed.

Question 31

Which two protocols are stateless and do not generate connection information needed to build a state table? (Choose two.)

Answer 31

Connectionless protocols, such as ICMP and UDP, are not stateful and do not generate connection information for a state table.

Question 32

What are two benefits of implementing a firewall in a network? (Choose two.)

Answer 32

There are several benefits of using a firewall in a network:
It prevents the exposure of sensitive hosts, resources, and applications to untrusted users.
It sanitizes protocol flow, which prevents the exploitation of protocol flaws.
It blocks malicious data from servers and clients.
It reduces security management complexity by off-loading most of the network access control to a few firewalls in the network.

Question 33

When implementing a ZPF, which statement describes a zone?

Answer 33

When implementing a zone-based policy firewall (ZPF), a zone is a group of one or more interfaces that have similar functions or features.