Which one among the following is the purpose of firewall?

Q: What is the answer to CDS (I) 2025 GK Q101?

A. Correct — A, Preventing unauthorised access to computer via the internet. A firewall sits at the boundary between a network you trust and one you do not, and its whole job is to decide what may cross. It inspects the traffic — at minimum the source and destination addresses, the port and the protocol of each packet, and in more capable products the state of the connection or the contents of the application-layer message — and then permits it, drops it or rejects it according to a rule set. The default posture of a well-configured firewall is to deny anything not expressly allowed, which is what turns it into a barrier against unauthorised access from the Internet. It can be a piece of software running on the computer itself, a host firewall, or a dedicated appliance guarding a whole network, and it may filter traffic leaving the machine as well as traffic arriving. What a firewall does not do is inspect files for malicious code. That is a different control with a different technique — signature and behaviour matching against known malware — and it is why option (d) is the near miss rather than the answer. A machine can have a perfectly configured firewall and still be infected by a file the user downloads over a connection the firewall was told to permit, which is precisely why the two products are sold and deployed together. (Provisional — pending the official UPSC key.)

(a)Preventing unauthorised access to computer via the internet
(b)Installation of software that can harm the computer
(c)Recording everything that is done on computer
(d)Running checks to prevent virus attacks

Answer

Why

Correct — A, Preventing unauthorised access to computer via the internet. A firewall sits at the boundary between a network you trust and one you do not, and its whole job is to decide what may cross. It inspects the traffic — at minimum the source and destination addresses, the port and the protocol of each packet, and in more capable products the state of the connection or the contents of the application-layer message — and then permits it, drops it or rejects it according to a rule set. The default posture of a well-configured firewall is to deny anything not expressly allowed, which is what turns it into a barrier against unauthorised access from the Internet. It can be a piece of software running on the computer itself, a host firewall, or a dedicated appliance guarding a whole network, and it may filter traffic leaving the machine as well as traffic arriving. What a firewall does not do is inspect files for malicious code. That is a different control with a different technique — signature and behaviour matching against known malware — and it is why option (d) is the near miss rather than the answer. A machine can have a perfectly configured firewall and still be infected by a file the user downloads over a connection the firewall was told to permit, which is precisely why the two products are sold and deployed together.

Why the others are wrong

(b)Installation of software that can harm the computer — Describes what an attacker or a piece of malware does, the opposite of a security control. A firewall is deployed to reduce the chance of hostile software reaching the machine, not to put it there.
(c)Recording everything that is done on computer — That is activity logging or, in its hostile form, spyware and keystroke logging. A firewall does keep logs of the traffic it allows and blocks, but recording everything done on the computer is not its purpose.
(d)Running checks to prevent virus attacks — The intended near miss — this is antivirus software. A firewall filters network traffic by address, port, protocol and connection state; it does not scan files against malware signatures. The two are complementary, not the same thing.

Concept

A firewall is a network security control placed between a trusted network or host and an untrusted one, which enforces a policy on the traffic crossing that boundary. Packet-filtering firewalls examine each packet's addresses, ports and protocol in isolation. Stateful firewalls also track whether a packet belongs to an established connection, so replies to traffic you initiated are allowed while unsolicited inbound connections are not. Application-layer firewalls, sometimes called proxies, understand the protocol in use and can filter on its contents. The governing principle is default deny — allow only what is explicitly permitted.

Computer-awareness questions on this paper are decided by keeping the four common security ideas apart, because the examiner builds every option out of one of them. A firewall controls access across a network boundary. Antivirus software detects and removes malicious code already present or arriving in files. Encryption protects the confidentiality of data in transit or at rest and does nothing about access. Authentication establishes who a user is, through a password, a token or a biometric. Read each option and ask which of the four it belongs to; here option (a) is access control, option (d) is antimalware, and options (b) and (c) describe attacks rather than defences. It is also worth being clear that a firewall's protection is only as good as its rule set: traffic on a port left open, or a connection the user starts herself, passes through it unhindered, which is why a firewall alone is not a complete defence.

Key facts

A firewall enforces an access control policy on traffic crossing the boundary between a trusted and an untrusted network.
Filtering decisions are made on source and destination addresses, ports, protocols and, in stateful products, the state of the connection.
The standard configuration principle is default deny — permit only traffic that a rule expressly allows.
A host firewall protects a single machine; a network firewall appliance protects an entire network segment.
A firewall does not scan files for malicious code; that is the work of antivirus or antimalware software, and the two are complementary controls.
Firewalls also filter outbound traffic, which can limit what an already compromised machine is able to send out.

Four security ideas the options are built from

Access control at the network boundary→The FIREWALL. Inspects traffic crossing between a trusted network and an untrusted one and permits or blocks it against a rule set.

Detecting malicious code→Antivirus or antimalware software. Matches files against signatures and behaviour — the work option (d) describes.

Recording user activity→Audit logging when the owner does it; spyware and keystroke logging when an attacker does. Option (c).

Installing harmful software→An attack, not a control. Option (b) describes what a firewall exists to reduce, not what it performs.

Sort each option into one of the four boxes and only one of them is a firewall.

Study next

Packet filtering, stateful inspection and application-layer proxies as generations of firewallAntivirus and antimalware — signature detection, heuristics and behavioural detectionMalware families: virus, worm, Trojan horse, ransomware, spyware and adwareEncryption and authentication as the other two pillars of information securityCommon attacks — phishing, denial of service, man-in-the-middle and SQL injection

Common traps

Treating a firewall as an antivirus. It filters network traffic; it does not scan files for malicious code.
Assuming a firewall blocks everything harmful; traffic the rules permit, including anything the user initiates, passes straight through.
Confusing a control with an attack — installing harmful software and logging everything a user does are things done to a machine, not by its defences.

As a one-line purpose question like this one, or as a statements item listing several functions and asking which are the firewall's, which is how the sibling CDS paper set it.

Related PYQs

CDS_GK_2025_II_Q852025

Which among the following are the purposes of deploying a Firewall? 1. Examine each packet arriving from Internet 2. Prevent unauthorised access 3. Block suspicious activity 4. Interconnect telephones Select the answer using the code given below:

(a) 1 and 2 only
(b) 1, 3 and 4
(c) 2 and 3 only
(d) 1, 2 and 3

Answer(c) 2 and 3 only

The same device tested six months later in the same examination cycle, this time as a list of functions. Examining each arriving packet, preventing unauthorised access and blocking suspicious activity are all the firewall's work, and interconnecting telephones — which belongs to a switchboard — is the odd one there just as antivirus scanning is the near miss here.

Practice

practice — not a real PYQ
A firewall makes its decisions primarily on the basis of which one of the following?
- (a)Signatures of known viruses
- (b)Source and destination addresses, ports and protocols of network traffic
- (c)The password strength of the user account
- (d)The physical location of the computer
Answer(b) Source and destination addresses, ports and protocols of network traffic — matching virus signatures is the work of antivirus software.
practice — not a real PYQ
The principle that a firewall should permit only traffic explicitly allowed by a rule and block everything else is known as which one of the following?
- (a)Default allow
- (b)Default deny
- (c)Fail open
- (d)Broadcast filtering
Answer(b) Default deny — the safer posture, since anything not anticipated by the rule set is blocked rather than permitted.