5.2 Firewall Types & Implementation (Doshi)

Question 1

Type of firewall

Answer 1

(1) Packet filtering router
(2) Stateful inspection
(3) Circuit level
(4) Application -level.

Question 2

Packet filtering router

Answer 2

(1) Simplest and earliest kind of firewall.
(2) Allow or Deny action is done as per IP address and port number of source & destination of packets.
(3) Works at Network Layer of OSI.

Question 3

Stateful inspection

Answer 3

(1) A Stateful Inspection firewall keeps track of the destination of each packet that leaves the internal network.
(2) It ensures that the incoming message is in response to the request that went out of the organization.
(3) Works at Network Layer of OSI.

Question 4

Circuit level

Answer 4

(1) Works on the concept of bastion host and proxy server.
(2) Same Proxy for all services.
(3) Works at Session Layer of OSI.

Question 5

Application -level.

Answer 5

(1) Works on the concept of bastion host and proxy server.
(2) Separate Proxy for each application.
(3) Works at Application Layer of OSI.
(4) Controls application such as FTP and HTTP.

Question 6

What is a bastion host?

Answer 6

On the Internet, a bastion host is the only host computer that a company allows to be addressed directly from the public network and that is designed to protect the rest of its network from exposure.

Question 7

What firewalls work on the concept of bastion hosting?

Answer 7

Circuit level and application level.

Question 8

What is a proxy?

Answer 8

(1) A proxy is a middleman.
(2) Proxy stands between internal and external network.
(3) Proxy will not allow direct communication between two networks.
(4) Proxy technology can work at different layer of OSI model

Question 9

What a circuit level proxy?

Answer 9

A proxy based firewall that works at lower layer (session layer) is referred to as circuit-level proxy.

Question 10

What is an application level proxy?

Answer 10

A proxy based firewall that works at higher layer (application layer) is called as an application level proxy

Question 11

Type of firewall implementations

Answer 11

(1) Dual-homed firewall,
(2) screened host firewall
(3) screened subnet firewall (DMZ)

Question 12

Characteristic of Dual-honned firewall

Answer 12

(1) One Packet Filtering Router

2) One bastion host with two NIC (Network Interface Card

Question 13

Characteristic of screened host firewall

Answer 13

(1) One Packet Filtering Router

(2) One Bastion Host

Question 14

Characteristic of screened subnet firewall (DMZ)

Answer 14

(1) Two Packet Filtering Router

(2) One Bastion Host

Question 15

Out of above firewalls, which firewall is the most secured type of firewall?

Answer 15

Application level

Question 16

Out of all firewall implementations, which type of firewall’s implementation provides greatest security environment?

Answer 16

Screen-Subnet Firewall (DMZ) is the most secured type of firewall implementation.

Question 17

Robust firewall configuration rule

Answer 17

Deny all traffic and allow specific traffic’ (as against ‘allow all traffic and deny specific traffic’).

Question 18

What traffic stateful Inspection Firewall allows?

Answer 18

Traffic from outside only if it is in response to traffic from internal hosts

Question 19

On What layer is the packet filtering firewall?

Answer 19

Network Layer (3rd layer)

Question 20

On What layer is the statefull inspestion firewall?

Answer 20

Network Layer (3rd layer)

Question 21

On what layer is the circuit level firewall?

Answer 21

Session layer (5th Layer)

Question 22

On what layer is the application level firewall?

Answer 22

Application layer (7th layer)

Question 23

Out of all types of firewall, Application-Level Firewall provides

Answer 23

GREATEST security environment (as it works on application layer of OSI model).

Question 24

In any given scenario, MOST robust configuration in firewall rule is

Answer 24

‘deny all traffic and allow specific traffic’ (as against ‘allow all traffic and deny specific traffic’).

Question 25

In any given scenario, Stateful Inspection Firewall

Answer 25

allows traffic from outside only IF it is in response to traffic from internal hosts.

Question 26

What is bastion host?

Answer 26

Both Application-Level Firewall as well as Circuit-Level Firewall works on concept of bastion hosting. On the Internet, a bastion host is the only host computer that a company allows to be addressed directly from the public network and that is designed to protect the rest of its network from exposure. Bastion host are heavily forfeited against attack.

Common characteristics of a bastion host are as follows:

• Its Operating system is hardened, in the sense that only essential services are installed on it.
• System should have all the unnecessary services disabled, unneeded ports closed, unused applications removed, unnecessary administrative tools removed i.e vulnerabilities to be removed to the extent possible.
• It is configured to require additional authentication before a user is granted access to proxy services.
• It is configured to access only specific hosts.

Question 27

What is Proxy?

Answer 27

A proxy is a middleman. Proxy stands between internal and external network. Proxy will not allow direct communication between two networks. Proxy technology can work at different layer of OSI model. A proxy based firewall that works at lower layer (session layer) is referred to as circuit-level proxy. A proxy based firewall that works at higher layer (application layer) is called as an application-level proxy.

Question 28

For CISA Exam, we need to remember three types of firewall implementation structure as follow:

Answer 28

(i)Dual-Homed Firewall

Characteristics:
(i)One Packet Filtering Router

(ii) One bastion host with two NIC (Network Interface Card).
(ii) Screened Host Firewall

Characteristics:

(i) One Packet Filtering Router
(ii) One Bastion Host
(iii) Screened subnet Firewall (Demilitarized Zone)

Characteristics:

(i) Two Packet Filtering Router
(ii) One Bastion Host

Question 29

Out of all types of firewall implementation structures, Screened Subnet Firewall (DMZ) provides GREATEST

Answer 29

security environment (as it implements 2 packet filtering router and 1 bastion host).