📝 Firewalls in computer networks (10 MCQs)

📖 From Data Communication and Networks • 32. Internet Security • 10 questions available

←Previous Topic:S/MIME secure email protocol📝 Firewalls in computer networksPacket filtering firewall explained:Next Topic→

What is Firewalls in computer networks?

A firewall is a network security device or software that monitors and controls incoming and outgoing traffic based on predetermined security rules, acting as a barrier between trusted internal networks and untrusted external networks.

Easy

Medium

Hard

📝 All Firewalls in computer networks MCQs

Q1. What is the primary function of a packet‑filter firewall?

A.Encrypts all outgoing traffic

B.Inspects packet headers to allow or deny based on IP addresses, ports, and protocols ✅

C.Scans email content for viruses

D.Provides user authentication for remote login

💡 Difficulty: easy | ✅ Correct: B

📖 Explanation: A packet‑filter firewall operates at the network layer, examining only the header information of each packet. It makes decisions based on source/destination IP addresses, protocol type, and port numbers, allowing or blocking traffic accordingly. It does not perform encryption, content scanning, or user authentication, which are functions of other security mechanisms.

Q2. If an organization replaces its packet‑filter firewall with a proxy firewall, which of the following outcomes is most likely?

A.All traffic will be routed through a single physical interface

B.The network will no longer require NAT for internal address translation

C.The firewall will be able to inspect and filter application‑layer payloads such as HTTP headers ✅

D.Packet throughput will increase because proxy firewalls are faster than packet filters

💡 Difficulty: easy | ✅ Correct: C

📖 Explanation: A proxy firewall operates at the application layer, so it can terminate client connections, examine full payloads, and enforce policies based on protocol semantics. This capability allows it to filter HTTP headers, MIME parts, and other application data, a function the simpler packet‑filter firewall cannot provide. The other options describe effects that are not typical of this transition.

Q3. When IPSec tunnel mode is deployed between two corporate sites, how does it affect the existing firewall rule set at each perimeter?

A.Firewalls must permit the ESP protocol (IP protocol 50) and treat the encapsulated traffic as a single flow, often requiring a rule that allows all protocols between the tunnel endpoints. ✅

B.Firewalls can continue to filter based on the original source and destination ports inside the encrypted payload.

C.Only the outer IP header is examined, so existing port‑based rules remain fully effective.

D.The use of tunnel mode eliminates the need for any firewall rules because the traffic is considered trusted.

💡 Difficulty: medium | ✅ Correct: A

📖 Explanation: In tunnel mode, the original IP packets are encapsulated inside a new IP header protected by ESP (protocol 50). The firewall therefore sees only the outer header, so it must allow ESP and typically create a rule that permits any traffic between the tunnel endpoints. Because the inner payload is encrypted, the firewall cannot apply port‑level filters until the traffic emerges from the tunnel, making the broader rule necessary.

Q4. Which statement best differentiates packet‑filter firewalls from proxy firewalls?

A.Packet‑filter firewalls operate at the transport layer, while proxy firewalls operate at the data link layer.

B.Proxy firewalls require no configuration of access control lists, unlike packet‑filter firewalls.

C.Packet‑filter firewalls can encrypt traffic, whereas proxy firewalls cannot.

D.Proxy firewalls provide both network‑layer filtering and deep inspection of application data, while packet‑filter firewalls only evaluate header fields. ✅

💡 Difficulty: medium | ✅ Correct: D

📖 Explanation: A packet‑filter firewall inspects only the network‑layer header fields—source/destination IP, protocol, and ports—to permit or deny traffic. In contrast, a proxy firewall acts as an intermediary at the application layer, terminating client connections, parsing the full payload, and applying content‑based policies. Therefore, proxy firewalls add deep inspection capabilities that packet filters lack, which is captured by the correct statement.

Q5. An enterprise deploys a hybrid security architecture that uses a packet‑filter firewall at the perimeter and a proxy firewall for internal web servers. Which of the following evaluations most accurately reflects the security posture?

A.The hybrid model reduces latency for internal users but creates a single point of failure at the proxy.

B.Combining both firewalls allows the packet filter to block unauthorized IPs, while the proxy adds content‑level protection, yielding layered defense against both network‑ and application‑layer attacks. ✅

C.The packet‑filter firewall renders the proxy redundant because it already inspects all traffic.

D.The architecture violates the principle of least privilege by exposing internal servers to the internet.

💡 Difficulty: hard | ✅ Correct: B

📖 Explanation: The hybrid approach embodies defense‑in‑depth: the perimeter packet‑filter firewall quickly discards traffic from disallowed IP addresses and protocols, while the internal proxy firewall performs deep packet inspection, content filtering, and user authentication for web services. This layered strategy protects against attacks targeting either the network layer or the application layer, providing a more robust security posture than either device alone.

Q6. Applying the principle of defense‑in‑depth, how should an organization integrate firewalls with IPSec VPNs to protect remote employee connections?

A.Place a packet‑filter firewall at the VPN gateway to validate IPSec ESP traffic and then enforce additional rules on decrypted payloads after the tunnel terminates. ✅

B.Rely solely on IPSec encryption and omit any firewall filtering because the tunnel is secure.

C.Use a proxy firewall inside the corporate LAN to inspect VPN traffic before it reaches the internal network.

D.Configure the firewall to block all IPSec traffic, forcing remote users to use unencrypted connections.

💡 Difficulty: medium | ✅ Correct: A

📖 Explanation: A robust deployment places a packet‑filter firewall at the VPN termination point to verify that only legitimate ESP (or AH) packets enter the network. After the IPSec tunnel is decrypted, the firewall can apply further policies—such as restricting access to specific subnets or services—thereby enforcing security both before and after the encrypted channel, consistent with defense‑in‑depth.

Q7. Consider a scenario where an email system uses PGP for personal communication and S/MIME for corporate messages. How does the presence of a proxy firewall influence the security guarantees of each method?

A.The proxy firewall can decrypt and re‑encrypt PGP messages, weakening their confidentiality.

B.S/MIME messages are unaffected because the firewall cannot process signed MIME parts.

C.Both PGP and S/MIME become vulnerable because the firewall terminates TLS sessions.

D.A proxy firewall can inspect the SMTP headers and enforce policy without breaking end‑to‑end encryption, preserving the cryptographic guarantees of both PGP and S/MIME. ✅

💡 Difficulty: hard | ✅ Correct: D

📖 Explanation: A proxy firewall operates at the application layer and can examine protocol metadata such as SMTP commands and headers while leaving the actual message body encrypted. Because PGP and S/MIME provide end‑to‑end encryption of the email content, the firewall’s inspection does not compromise confidentiality or integrity. Therefore, the firewall can enforce policies without undermining the cryptographic protections offered by either scheme.

Q8. Which of the following best illustrates how a proxy firewall can mitigate a zero‑day exploit targeting a web application?

A.By blocking all inbound traffic on port 80, preventing any HTTP requests.

B.By allowing only encrypted HTTPS traffic, thereby hiding the exploit.

C.By terminating the client’s HTTP connection, inspecting the request and response for suspicious payloads, and refusing to forward malicious content to the server. ✅

D.By routing traffic through a load balancer that masks the vulnerability.

💡 Difficulty: medium | ✅ Correct: C

📖 Explanation: A proxy firewall acts as an intermediary that terminates the client’s HTTP session, allowing it to parse the full request and response. Even unknown (zero‑day) attacks can be detected by heuristics or anomaly detection on the payload. When malicious content is identified, the firewall can drop or sanitize it before it reaches the vulnerable web application, thereby providing a protective layer that pure network filters cannot offer.

Q9. When comparing the performance impact of packet‑filter firewalls versus proxy firewalls, which inference is most accurate?

A.Proxy firewalls always provide higher throughput because they operate at a higher OSI layer.

B.Packet‑filter firewalls typically introduce less latency because they examine only header information, whereas proxy firewalls must process full payloads. ✅

C.Both types have identical performance characteristics under heavy load.

D.Packet‑filter firewalls consume more CPU cycles due to deep packet inspection.

💡 Difficulty: easy | ✅ Correct: B

📖 Explanation: Packet‑filter firewalls operate on the network layer and evaluate only the packet header, which requires minimal processing time and results in lower latency and higher throughput. Proxy firewalls, by contrast, must terminate sessions, decode full application payloads, and apply content‑based policies, which adds processing overhead and can reduce performance, especially under heavy traffic loads.

Q10. If a network administrator observes that a proxy firewall is logging frequent “CONNECT” method requests to external ports, what logical conclusion can be drawn about the traffic pattern?

A.Clients are attempting to establish TLS tunnels through the proxy, indicating use of HTTPS or other SSL/TLS services. ✅

B.The firewall is blocking all outbound traffic, forcing clients to use the CONNECT method as a workaround.

C.The network is experiencing a denial‑of‑service attack targeting the proxy’s HTTP parser.

D.Internal servers are misconfigured to send outbound SMTP traffic via the proxy.

💡 Difficulty: medium | ✅ Correct: A

📖 Explanation: The HTTP CONNECT method is used by clients to request that a proxy open a TCP tunnel to a specified host and port, which is commonly employed for HTTPS or other SSL/TLS connections. Frequent CONNECT logs therefore indicate that many clients are initiating encrypted sessions through the proxy, reflecting normal TLS traffic rather than a misconfiguration or attack.

🔗 Related Topics (MCQs)

📝 IPSec network layer security MCQs 📝 IPSec transport and tunnel modes: Two Modes MCQs 📝 IPSec AH and ESP Two Security Protocols MCQs 📝 IPSec security services MCQs 📝 Security Association in IPSec MCQs

←Previous Topic:S/MIME secure email protocol📝 Firewalls in computer networksPacket filtering firewall explained:Next Topic→