200-201 Question 253
Select 2A network security analyst is configuring a firewall to enhance security for a corporate network. The analyst needs to inspect data packets to identify threats hidden within application layer content, while also ensuring that the firewall maintains the context of active connections to allow or block traffic. Which type of technology should the analyst use?
- A
Deep Packet Inspection (DPI)
- B
Packet Filtering
- C
Stateless Firewall
- D
Stateful Firewall
Show answer and explanation
Correct answers: A, D
Explanation
To detect threats hidden in application layer content, the analyst needs Deep Packet Inspection (DPI), which examines the entire packet payload. Additionally, a Stateful Firewall keeps track of connection states, allowing it to make dynamic decisions for traffic filtering while maintaining security context. Combining these technologies enhances network security by addressing both content-level threats and connection-level control.
- A. Correct.
Deep Packet Inspection (DPI) examines the entire content of a packet, including the application layer, to identify threats or anomalies, making it suitable for detecting malicious payloads or application-specific attacks.
- B. Incorrect.
Packet Filtering only evaluates packets based on static criteria such as source and destination IP addresses or ports. It does not inspect the content of packets or maintain connection context, making it less effective for advanced threat detection.
- C. Incorrect.
Stateless Firewalls do not track the state of network connections and rely solely on predefined rules for packet filtering. They cannot handle complex traffic inspection or context-based decisions.
- D. Correct.
Stateful Firewalls maintain the state of active connections and make decisions based on the context of the traffic flow, providing an additional layer of security compared to stateless firewalls.