CompTIA Tech+ (FC0-U71)SecurityHard
A company is concerned about employees installing unauthorized software or accessing malicious websites. They want a solution that can inspect network traffic at the application layer, identify specific applications, and enforce granular policies based on content. Which type of firewall would best meet these requirements?
- ANext-Generation Firewall (NGFW)
- BStateful firewall
- CPacket-filtering firewall
- DProxy firewall
Show answer & explanationAnswer & explanation
Correct answer: A. Next-Generation Firewall (NGFW)
Next-Generation Firewalls (NGFWs) go beyond traditional packet filtering and stateful inspection. They include deep packet inspection, application awareness, and integrated intrusion prevention systems (IPS) to identify and control applications, user identities, and content, which directly addresses the company's need for granular control over unauthorized software and malicious websites.
Why the other options are wrong
- B. Stateful firewalls track the state of connections but still primarily operate at the network/transport layers and lack application-level awareness for granular content control.
- C. Packet-filtering firewalls operate at lower network layers (IP, TCP/UDP) and cannot inspect application-layer traffic or identify specific applications.
- D. Proxy firewalls operate at the application layer and can filter content, but NGFWs offer a more comprehensive suite of features, including integrated IPS and threat intelligence, for broader protection against unauthorized software and malicious websites.
Next-Generation Firewall (NGFW)
A deep-packet inspection firewall that combines the capabilities of a traditional firewall with additional features like application control, intrusion prevention, and advanced threat intelligence.
- Operates at the application layer (Layer 7).
- Provides application awareness and control.
- Includes integrated Intrusion Prevention System (IPS) and URL filtering.
Memory trick: Firewall's next-gen is smart and deep.