Which two components are part of a next-generation firewall security policy? (Choose two.)

Question

Options

• Arole-based access controls
• Buser identification
• Ccontent identification
• Dfile permissions

• A
  7% (2)
• B
  90% (26)
• C
  3% (1)

Explanation

User identification (B) is a defining feature of next-generation firewalls (NGFWs) - they tie network traffic to specific users rather than just IP addresses, enabling identity-aware policies. Content identification (C) is equally core to NGFWs, allowing the firewall to inspect and classify application traffic and data at Layer 7 regardless of port. Note: since the question says "choose two," both B and C are correct; the listed answer of only B appears incomplete.

Why the distractors are wrong:

• A (role-based access controls) is a general authorization model used across many systems, not a specific component of an NGFW security policy.
• D (file permissions) is an operating system concept for controlling access to files - completely outside the scope of firewall policy.

Memory tip: Think of NGFW as "WHO is doing WHAT" - User identification answers who, and Content identification answers what. Traditional firewalls only knew where (IP/port). That shift is the entire point of "next-generation."

No community discussion yet for this question.