200-201 Question 254
Single answerA cybersecurity analyst is tasked with implementing a firewall solution for a company's network. The main requirements are that the solution should allow granular inspection of data at the application layer and detect threats embedded within packet payloads. Which type of firewall operation is most appropriate for this scenario?
- A
Packet filtering
- B
Stateful firewall operation
- C
Deep packet inspection
- D
Static NAT (Network Address Translation)
Show answer and explanation
Correct answer: C
Explanation
The scenario explicitly requires a solution capable of inspecting data at the application layer and detecting threats in packet payloads. Deep packet inspection (DPI) is uniquely suited for these tasks, as it evaluates both the header and content of packets, providing a more thorough analysis compared to packet filtering or stateful firewall operations. DPI is therefore the correct choice for the given requirements.
- A. Incorrect.
Packet filtering only evaluates packet headers, such as source/destination IP and port numbers, and does not inspect the actual payload. It is not suitable for detecting threats within packet contents or application-layer data.
- B. Incorrect.
Stateful firewall operation tracks the state of active connections and ensures packets are part of a valid session. However, it does not perform detailed inspection of packet payloads or application-layer data.
- C. Correct.
Deep packet inspection examines both the headers and payloads of packets, allowing detection of threats embedded in the data and providing granular application-layer filtering. This makes it the most appropriate choice for the scenario described.
- D. Incorrect.
Static NAT is a network address translation method that maps private IP addresses to public IP addresses. It does not provide any inspection or filtering capabilities relevant to the scenario.