212-82 Question #131: Real Exam Question with Answer & Explanation

Question

A large multinational corporation is In the process of upgrading its network infrastructure to enhance security and protect sensitive data. As part of the upgrade, the IT team is considering implementing stateful multilayer inspection firewalls and application-level gateway firewalls. How do stateful multilayer inspection firewalls differ from application-level gateway firewalls in terms of their packet filtering capabilities and the layers of the OSI model they inspect?

Options

• AStateful multilayer inspection firewalls are more expensive and require competent personnel to
• BStateful multilayer inspection firewalls track and maintain session information between hosts, while
• CStateful multilayer inspection firewalls focus on inspecting packets at the application layer, while
• DStateful multilayer inspection firewalls filter traffic based on specified application rules,

Explanation

Stateful multilayer inspection firewalls track session information and inspect up to Layer 4, whereas application-level gateway firewalls act as proxies, inspecting traffic at Layer 7.

Common mistakes.

• A. This statement describes aspects like cost and personnel requirements, which are not technical distinctions concerning packet filtering capabilities or OSI layers of operation.
• C. This is incorrect; stateful multilayer inspection firewalls primarily inspect at Layer 3 and 4, tracking connection states, while application-layer inspection is a characteristic of application-level gateway firewalls.
• D. This is incorrect; stateful multilayer inspection firewalls primarily focus on connection states and basic protocol compliance at lower layers, while filtering traffic based on specified application rules is a function of application-level gateways or next-generation firewalls.

Concept tested. Firewall types and OSI layer inspection

Reference. https://learn.microsoft.com/en-us/azure/architecture/framework/security/firewall-guidance

No community discussion yet for this question.