Firewalls

Question 1

What is the primary function of a firewall?

Answer 1

Screen traffic between two portions of a network.

Question 2

What are the three types of firewall?

Answer 2

Software
Hardware
Embedded

Question 3

What is a software firewall?

Answer 3

It’s a software based firewall that’s run on a host or a server.

Question 4

What is a hardware firewall?

Answer 4

A stand alone device installed into the network.

Question 5

What is an embedded firewall?

Answer 5

It works as a single function on a single device. It’s one piece of a device that has many different functions. It is built into a router or a unified threat management device.

Question 6

What are the different firewall methods?

Answer 6

Packet Filtering
MAC Filtering
NAT Filtering
Application-layer gateways
Circuit-level gateways
Web Application Firewall

Question 7

What is packet filtering?

What are the two types?

Answer 7

Inspection of each packet passing through. The firewall accepts or rejects based on the firewall rules.

Stateless and Stateful

Question 8

What is the difference between stateless and stateful packet filtering?

Answer 8

Stateless: Accepts/rejects specifically based on firewall rules.

Stateful: Tracks requests that leave through the firewall, and then temporarily opens a port for the return traffic. It inspects the header of each packet received to verify its coming in for the tracked request.

Question 9

What is MAC filtering?

Answer 9

Filters outbound traffic based on MAC address

Question 10

What is NAT filtering?

Answer 10

Filters traffic based on ip/port used and TCP or UDP.

Question 11

What is application-layer gateway firewall?

Answer 11

An in-depth packet inspection that determines the application the packet is intended for. Resource intensive. Known as a layer 7 firewall because it operates at the application layer.

Question 12

What is a circuit-level gateway firewall?

Answer 12

Applies security checks when a TCP or UPD session establishment. Once its cleared at session establishment, it no longer checks packets. Operates at the session layer.

Question 13

Explain the differences between Explicit Allow, Explicit Deny, and Implicit Deny.

Answer 13

Explicit Allow: Whitelist - If you’re on the list, you may pass.

Explicit Deny: Blacklist - If you’re on the list, you may not pass.

Implicit Deny: Anything that does not have a rule, is denied.

Question 14

What is a Web Application Firewall (WAF)?

Answer 14

Firewall installed to protect a server by inspecting traffic sent to/from a web application.

Note: WAF is excellent at preventing XXS or SQL injections.