A penetration test was done at a company. After the test, a report was written and given to the company's IT authorities. A section from the report is shown below: Access List should be written betwee

A stateful firewall inspects and filters data packets based on connection state and rule sets, making it the appropriate security solution to place between the intranet (LAN) and the DMZ as described. The report specifically calls for a solution that filters data packets in this network segment, which aligns directly with the core function of a stateful firewall. This is a standard network security architecture practice for segmenting trusted and semi-trusted zones.

The report states that an access list SHOULD BE written between VLANs, indicating that no such access control policy currently exists rather than confirming one is already in place.

Enabling port security reduces the risk of MAC-based attacks but does not fully prevent MAC spoofing, as an attacker can still forge a valid MAC address to circumvent port security controls.

A WAF reduces the attack surface for SQL injection but does not eliminate the possibility of such attacks, since misconfigurations or WAF bypass techniques can still allow exploitation.