Which of the following descriptions of the principles of file filtering technology are correct? (Multiple choice)

Question

Options

• ACan identify the application protocol hosting the file
• BCan be identified based on the transmission direction of the file
• CFile filtering cannot identify the real file type
• DBy default, if the firewall file recognition result is abnormal, it will be blocked directly.

• A
  74% (14)
• C
  11% (2)
• D
  16% (3)

Explanation

A and B are correct because file filtering technology in next-generation firewalls operates at the application layer, giving it two key capabilities: it can inspect which application protocol (HTTP, FTP, SMTP, etc.) is carrying the file, and it can apply policies based on transfer direction - for example, allowing downloads but blocking uploads of certain file types.

C is wrong because modern file filtering identifies the true file type by inspecting file headers and magic bytes, not just the file extension. This means it correctly detects a malicious executable even if it's renamed .txt.

D is wrong because the typical default behavior when file recognition produces an abnormal or indeterminate result is to permit the file (and optionally log it), not block it. Blocking unknown results would cause too many false positives and disrupt normal traffic.

Memory tip: Think of file filtering as a security guard who knows which door a visitor came through (protocol = A), which direction they're moving (direction = B), can check their real ID not just their name tag (true type detection, so C is false), and who waves through anyone they can't identify rather than turning everyone away (default permit on unknown, so D is false).

No community discussion yet for this question.