Free Network Defenses practice questions

Unified threat management combines a stateful firewall, intrusion prevention, gateway antivirus, content filtering and more in one appliance with one console, aimed at small sites with limited staff. A web application firewall protects web applications only, a stateless ACL just filters packets, and host firewalls protect each device without adding IPS or web filtering.

A per-IP threshold does little when each address sends only a handful of attempts, so real deployments combine per-IP, per-account and global thresholds to catch distributed guessing. A stricter per-IP limit still lets five slow attempts from each address through, a nonstandard port only hides the page, and an IDS signature alerts without slowing anything down.

A stateless filter judges each packet alone, so a rule that admits anything from source port 443 can't tell a real web reply from an attacker who sets their own source port to 443 while scanning. A stateless ACL keeps no state table, so there is nothing to exhaust or time out, and tunneling over 443 is an outbound Layer 4 problem rather than a flaw in this inbound rule.

A reject answers with a TCP reset or an ICMP unreachable message, so a legitimate client fails fast instead of timing out, while a silent drop gives a scanner nothing back. Rejecting everywhere would answer internet scanners, dropping everywhere leaves the internal clients hanging, and the reverse arrangement gets both requirements wrong.

A /29 holds 8 addresses, so 172.20.8.0/29 runs from .0 to .7 and the host at .9 doesn't match rule 1. Rule 2 matches every field, so the connection is denied there and nothing below is consulted. Rule 3 is for port 443, not 22, and rule 4 is never reached because the first full match decides.

Every ACL ends with an invisible implicit deny, so a list made only of deny statements blocks everything; to block a few things and allow the rest, it needs an explicit permit at the end. The order of the deny lines doesn't matter when they all deny, an explicit deny any any would only add logging, and the established keyword is for admitting replies, not for deny lines.

An allow any any at the bottom catches everything the rules above didn't, so it quietly replaces default deny with default allow and the firewall becomes little more than a router. The implicit deny is the invisible final rule, so it is never reached when an explicit allow-all sits above it. An allow rule doesn't merely log, and it isn't limited to return traffic.

DNS uses UDP 53 for most queries but TCP 53 for zone transfers and large responses, so a DNS server rule usually needs both. UDP 123 is NTP and ICMP echo is ping, and a stateful firewall already admits replies, so an extra UDP 53 rule in the other direction wouldn't carry a transfer that runs over TCP.

A reverse proxy sits in front of servers, accepts connections from internet clients and passes requests to the real servers, which keeps them off the internet; it commonly terminates TLS and balances load. A forward proxy serves internal users going out, and DLP and DNS filtering control data leaving and sites visited, not inbound access to servers.

The proxy re-signs each site with certificates from an internal CA that managed devices are configured to trust, so devices missing that root certificate warn on every HTTPS site. A proxy that skipped validating real servers would hide warnings rather than cause them, pinning breaks only specific applications, and a stolen CA key would let an attacker impersonate sites without any warning.