Firewalls and packet filtering in Computer Networks - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

How does a stateful firewall differ from a stateless firewall?

Which of the following best describes the main difference between a stateful firewall and a stateless firewall?

A A stateless firewall encrypts data packets, while a stateful firewall does not.

B A stateless firewall uses machine learning to detect threats, while a stateful firewall uses fixed rules.

C A stateful firewall only filters incoming packets, while a stateless firewall filters both incoming and outgoing packets.

D A stateful firewall tracks the state of active connections, while a stateless firewall filters packets individually without context.

💡 Hint

Think about whether the firewall remembers previous packets or treats each packet on its own.

Stateful firewalls keep track of the connection state and context, allowing them to make more informed decisions. Stateless firewalls treat each packet independently without memory of past packets.

📋 Factual

intermediate

What is the primary function of a packet filter firewall?

What is the main role of a packet filter firewall in network security?

A To filter packets based on source and destination IP addresses and ports.

B To inspect the content of data packets and block viruses.

C To encrypt all network traffic between two points.

D To monitor user behavior and block suspicious activities.

💡 Hint

Consider what basic information is available in packet headers.

Packet filter firewalls examine packet headers such as IP addresses and port numbers to decide whether to allow or block packets.

🔍 Analysis

advanced

Analyzing firewall rule order impact

Given these firewall rules applied in order, what will happen to a packet from IP 192.168.1.10 to port 80?

1. Deny all traffic from 192.168.1.0/24
2. Allow traffic to port 80

A The packet will be allowed because the allow rule matches port 80.

B The packet will be denied because the deny rule matches the source IP first.

C The packet will be allowed because rules are applied simultaneously.

D The packet will be denied because port 80 is blocked by default.

💡 Hint

Remember that firewall rules are processed in order, and the first matching rule applies.

The first rule denies all traffic from the 192.168.1.0/24 subnet, so the packet is blocked before reaching the allow rule.

❓ Comparison

advanced

Comparing firewall types for application layer filtering

Which firewall type is best suited for filtering traffic based on application data, such as HTTP requests?

A Proxy firewall

B Stateful firewall

C Packet filter firewall

D Circuit-level gateway

💡 Hint

Think about which firewall can inspect the actual content of the communication.

Proxy firewalls act as intermediaries and can inspect application layer data, allowing them to filter based on content like HTTP requests.

❓ Reasoning

expert

Identifying the cause of a firewall bypass

A network administrator notices that unauthorized traffic is passing through the firewall despite rules blocking it. Which of the following is the most likely cause?

A The unauthorized traffic uses a protocol that firewalls cannot inspect.

B The firewall hardware is physically damaged and cannot filter packets.

C The firewall is configured with overlapping rules that allow the traffic before the block rule.

D The firewall is set to block all traffic by default.

💡 Hint

Consider how rule order and overlaps affect firewall behavior.

Overlapping rules where an allow rule appears before a block rule can cause unauthorized traffic to pass through because the first matching rule is applied.