Which type of attack can a firewall NOT prevent?

Network bandwidth saturation attacks flood the ISP uplink or WAN circuit with massive traffic volumes, exhausting all available bandwidth upstream of the firewall so that legitimate traffic cannot reach the network regardless of firewall rules. Mitigation requires upstream scrubbing centers, ISP-level black-holing, or anycast diffusion - all outside the firewall's enforcement point.

Buffer overflow attacks embed exploit payloads in network traffic, and a firewall with IPS capabilities can inspect packet content and block known exploit signatures before they reach a vulnerable service.

SYN Flood attacks exhaust TCP connection tables, but a stateful inspection firewall can mitigate this by enforcing SYN cookies or connection rate limits at the device level.

SQL Injection attacks are carried in HTTP/HTTPS request parameters, and an application layer firewall or WAF can parse and block malicious SQL strings in the payload.