📝 Packet filtering firewall explained (12 MCQs)
📖 From Data Communication and Networks • 32. Internet Security • 12 questions available
What is Packet filtering firewall explained?
A packet filtering firewall inspects individual packets at the network and transport layers, making allow or deny decisions based solely on header information such as source/destination IP addresses, ports, and protocols without examining packet contents.
📝 All Packet filtering firewall explained MCQs
Q1. What is the primary function of a packet‑filter firewall?
📖 Explanation: The firewall examines each packet's header fields—such as source/destination IP, ports, and protocol—and then decides to permit or block the packet according to the configured rule set. This inspection is the core purpose of a packet‑filter firewall, distinguishing it from functions like encryption or VPN provisioning.
Q2. A rule set contains: (1) deny all inbound traffic, (2) allow inbound TCP to port 22, (3) allow inbound TCP to port 80. Rules are evaluated top‑down. Which inbound packet will be permitted?
📖 Explanation: Because the first rule explicitly denies every inbound packet, the firewall never reaches the subsequent allow rules. Consequently, any inbound packet—whether targeting port 22, port 80, or any other service—is blocked, making “None of the above” the correct choice.
Q3. Compared with a stateful firewall, a pure packet‑filter firewall typically...
📖 Explanation: A packet‑filter firewall operates without storing session state, so it processes each packet independently. This stateless nature reduces memory and CPU usage, allowing it to run with fewer resources than a stateful firewall, which must maintain connection tables and track ongoing sessions. Hence, resource efficiency is the primary distinction.
Q4. To prevent IP spoofing on the external interface, which rule correctly implements source‑IP validation?
📖 Explanation: Spoofed packets often claim an internal address while arriving on the external interface. By denying any packet whose source address belongs to the internal network (10.0.0.0/8) on the external interface, the firewall discards these forged packets, effectively mitigating IP‑spoofing attempts.
Q5. If a rule allowing all TCP traffic appears before a rule denying traffic to 10.0.0.0/8, what happens to a TCP packet destined for 10.1.2.3?
📖 Explanation: Packet‑filter firewalls evaluate rules sequentially. The first matching rule determines the action. Since the permissive TCP rule precedes the more specific deny rule, the packet matches the earlier allow rule and is permitted, even though its destination falls within the later denied subnet.
Q6. Increasing the number of rules in a packet‑filter firewall most directly affects which of the following?
📖 Explanation: Each incoming packet must be compared against every rule until a match is found. Adding more rules lengthens this comparison process, consuming additional CPU cycles and reducing the amount of traffic the firewall can handle per second, thereby impacting overall throughput.
Q7. When NAT is applied before packet filtering, which security advantage is gained?
📖 Explanation: By translating internal private addresses to a public address prior to filtering, the firewall masks the true source of outbound packets. This concealment prevents external entities from directly targeting internal hosts, adding a layer of anonymity and reducing exposure to reconnaissance attacks.
Q8. Consider the ordered rules: 1) deny TCP any → 10.0.0.0/8, 2) allow TCP any → 10.0.0.0/16, 3) deny TCP any → any. A TCP packet from 192.168.1.5 to 10.0.5.7 arrives. What final action is taken?
📖 Explanation: The packet’s destination matches the first rule (10.0.0.0/8), which issues a deny. Because rule processing stops at the first match, later rules—including the more specific allow for /16—are never evaluated, resulting in the packet being denied.
Q9. Which statement best captures the security implication of a default‑allow policy in a packet‑filter firewall?
📖 Explanation: A default‑allow stance means any packet that does not match an explicit deny rule is allowed to pass. This openness can let unexpected or malicious traffic traverse the network, enlarging the attack surface and contravening the principle of least privilege.
Q10. Why can a stateless packet‑filter firewall not enforce that a TCP connection follows the three‑way handshake?
📖 Explanation: Stateless firewalls treat each packet in isolation, without retaining any session information. Because the TCP three‑way handshake relies on tracking SYN, SYN‑ACK, and ACK packets across time, the firewall cannot verify the sequence without storing state, rendering it incapable of enforcing proper handshakes.
Q11. A firewall has internal interface eth0 (192.168.1.0/24) and external interface eth1 (203.0.113.0/24). Rule: allow inbound TCP from any to eth1 port 443. Which traffic is permitted?
📖 Explanation: The rule explicitly permits inbound TCP destined for the external interface (eth1) on port 443, regardless of source. Therefore, a packet originating from the internal network (192.168.1.10) and targeting the external address (203.0.113.5) on port 443 matches and is allowed.
Q12. Which subnet mask correctly matches the address range 192.168.10.0 – 192.168.10.255?
📖 Explanation: A mask of 255.255.255.0 (or /24) preserves the first three octets and varies only in the last octet, covering all addresses from .0 to .255 within the 192.168.10.x network. The other masks either span a larger range or split the /24 into smaller subnets.)