A penetration test was done at a company. After the test, a report was written and given to the company's IT authorities. A section from the report is shown below: - Access List should be written betw

Port security limits MAC addresses per port to reduce MAC spoofing risk, but it cannot fully prevent MAC spoofing attacks - it only raises the difficulty, so the claim that they 'cannot be performed' is false.

A WAF reduces the attack surface for SQL injection by filtering malicious input, but it does not eliminate the possibility entirely since WAF bypass techniques exist.

The report explicitly recommends 'a security solution which filters data packets' between the intranet and DMZ. A stateful firewall inspects and filters packets based on connection state and packet headers, which directly matches this description, making it a valid and appropriate solution for that network segment.

The report states that access lists 'should be written' between VLANs, meaning this control does not yet exist - it is a recommendation, not a current implemented policy.