200-201 Question 105
Select 3During a security audit, a network administrator observes that a traditional stateful firewall is not blocking certain types of traffic as expected. The administrator notices that the firewall is only examining Layer 3 and Layer 4 information. Which of the following types of traffic would NOT be effectively filtered by this firewall?
- A
Malicious HTTP requests containing SQL injection payloads
- B
Traffic from a specific IP address and port based on an ACL
- C
Encrypted traffic using HTTPS
- D
Traffic matching established TCP connections
- E
Traffic based on application-layer protocols like DNS queries
Show answer and explanation
Correct answers: A, C, E
Explanation
Traditional stateful firewalls examine traffic based on Layer 3 and Layer 4 information, such as IP addresses, ports, and connection states. They are unable to inspect or filter application-layer data (Layer 7) or analyze encrypted traffic without additional capabilities like deep packet inspection or SSL decryption. As such, they are ineffective against malicious payloads within HTTP requests, encrypted traffic, or application-layer protocols like DNS.
- A. Correct.
Traditional stateful firewalls do not inspect application-layer data, so they cannot detect specific malicious payloads such as SQL injection in HTTP requests.
- B. Incorrect.
Stateful firewalls can effectively block traffic based on IP address and port using access control lists (ACLs).
- C. Correct.
Encrypted HTTPS traffic cannot be inspected by traditional stateful firewalls unless decryption is performed, which is beyond their capabilities.
- D. Incorrect.
Stateful firewalls are designed to track the state of TCP connections, so they can effectively monitor and allow traffic matching established TCP connections.
- E. Correct.
Traditional stateful firewalls do not inspect application-layer protocols like DNS. They only operate at Layers 3 and 4 (IP and transport layers).