Several months after the installation of a new firewall with intrusion prevention features to block malicious activity, a breach was discovered that came in through the firewall shortly after…

Web surfing controls prevent users from accessing certain websites but do not detect breaches coming *in* through the firewall after a successful intrusion.

Packet filtering is a basic firewall function to block traffic based on rules, but it does not *detect* a breach that has already successfully passed through.

Application awareness allows the firewall to understand and control application-specific traffic, which is a prevention feature, not an early detection mechanism for a successful breach.

Firewall logs contain records of all traffic, including denied and allowed connections; regular log monitoring helps identify anomalous patterns or successful penetrations that indicate a breach, even if initial prevention failed. This enables proactive response before significant damage occurs.