NSE4 · Question #111
Which of the following items is NOT a packet characteristic matched by a firewall service object?
The correct answer is D. TCP sequence number. Firewalls match packet characteristics like ICMP type/code, TCP/UDP ports, and IP protocol number to enforce policies, but not the TCP sequence number.
Question
Which of the following items is NOT a packet characteristic matched by a firewall service object?
Options
- AICMP type and code
- BTCP/UDP source and destination ports
- CIP protocol number
- DTCP sequence number
How the community answered
(47 responses)- A2% (1)
- B6% (3)
- C4% (2)
- D87% (41)
Why each option
Firewalls match packet characteristics like ICMP type/code, TCP/UDP ports, and IP protocol number to enforce policies, but not the TCP sequence number.
ICMP type and code are essential fields for controlling ICMP traffic and are commonly used in firewall service objects.
TCP/UDP source and destination ports are fundamental identifiers for applications and services, widely used in firewall service objects.
The IP protocol number (e.g., 6 for TCP, 17 for UDP, 1 for ICMP) is a crucial Layer 3 characteristic used by firewalls to identify the protocol being carried.
The TCP sequence number is part of the TCP header used for reordering and reliability within a session, but it is not a standard criterion matched by firewall service objects to define traffic for policy enforcement.
Concept tested: Firewall service object matching criteria
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/469442/creating-a-service
Topics
Community Discussion
No community discussion yet for this question.