Firewall types, DMZ, IDS versus IPS, VPN protocols, NAC, segmentation, proxies and common network attacks.
40 cards · basic cards · AI-written, checked twice. Edit anything.
- What distinguishes a stateless firewall from other firewall types?
Show answer
It makes filtering decisions based only on packet headers (source/destination IP and port) without tracking connection state.- How does a stateful firewall differ from a stateless firewall?
Show answer
A stateful firewall tracks active connections and permits return traffic for established connections, while stateless firewalls make decisions per-packet without state.- What does packet-filtering do and at which OSI layers does it operate?
Show answer
Packet-filtering examines packet headers and makes allow/deny decisions at layers 3-4 (network/transport), based on IP addresses and ports.- What is a next-generation firewall (NGFW)?
Show answer
An NGFW combines traditional firewall capabilities with application-layer inspection, IDS/IPS, threat prevention, and advanced features in one appliance.- What does deep packet inspection (DPI) enable in a firewall?
Show answer
DPI allows inspection of packet payloads beyond headers, enabling detection and blocking of malicious content, protocols, and application-layer threats.- What is a proxy firewall?
Show answer
A proxy firewall acts as an intermediary that terminates client connections and initiates new connections to destinations, filtering at the application layer.- What is a demilitarized zone (DMZ)?
Show answer
A DMZ is a network segment between an organization's internal network and the untrusted internet, hosting externally-accessible services.- What services are typically deployed in a DMZ?
Show answer
Web servers, email servers, DNS servers, FTP servers, and other services requiring external access while protecting the internal network.- Why does a DMZ architecture improve security?
Show answer
It isolates public-facing services from internal assets, containing breaches so a compromised DMZ server cannot directly access sensitive internal systems.- What is a dual-homed DMZ architecture?
Show answer
A DMZ using two firewalls: one between the internet and DMZ, and a second between the DMZ and the internal network.- What is an Intrusion Detection System (IDS)?
Show answer
An IDS monitors network traffic and generates alerts when suspicious or malicious activity is detected, but does not block traffic.- What is an Intrusion Prevention System (IPS)?
Show answer
An IPS monitors network traffic, detects threats, and actively blocks or prevents malicious traffic in addition to generating alerts.- What is the key operational difference between IDS and IPS?
Show answer
IDS detects and alerts on threats; IPS detects and blocks threats. IDS is passive monitoring, IPS is active prevention.- What is signature-based intrusion detection?
Show answer
Detection based on matching traffic patterns and content against known attack signatures stored in a detection database.- What is anomaly-based intrusion detection?
Show answer
Detection based on deviations from established normal network behavior patterns, allowing identification of previously unknown attacks.
FlashKeepers