Which among the following are the purposes of deploying a Firewall? 1. Examine each packet arriving from Internet 2. Prevent unauthorised access 3. Block suspicious activity 4. Interconnect telephones Select the answer using the code given below:

Correct — D, 1, 2 and 3. A firewall is a network security system that monitors and controls the traffic crossing a boundary — typically between a trusted internal network and an untrusted one such as the Internet — and applies a configurable set of rules to decide what may pass. Examining each packet arriving from the Internet is not an incidental feature of that; it is the mechanism itself. The earliest firewalls were packet filters that read the source and destination addresses, the protocol and the port numbers out of every header and compared them against a rule list, and even a modern stateful or application-layer firewall still starts from inspection of the traffic before it decides. Statements 2 and 3 are what that inspection is for. Preventing unauthorised access is the purpose a firewall was invented to serve, by refusing connections that no rule permits. Blocking suspicious activity is the same power turned outward and inward — dropping traffic to a known bad address, closing a port that should not be open, stopping a compromised machine inside the network from reaching out. Statement 4 is the only false one on the list: interconnecting telephones is the work of a private branch exchange or a switchboard, which shares nothing with a firewall but the general idea of a device sitting between two sides.

• (a)1 and 2 only — Drops the blocking of suspicious activity, which is exactly what a rule list is written to do once a packet has been inspected and found unwelcome.
• (b)1, 3 and 4 — Includes the one plainly false statement. Interconnecting telephones is the job of a private branch exchange; nothing in a firewall's design touches voice switching.
• (c)2 and 3 only — Drops statement 1, which cannot be dropped. A firewall prevents unauthorised access and blocks suspicious traffic precisely by examining the packets that arrive, so rejecting the mechanism while keeping its two results is not a coherent reading.

A firewall sits at the boundary of a network and enforces a policy about what traffic may cross it. The simplest kind is a packet filter, which reads the header of each packet — source and destination address, protocol, port numbers — and matches it against an ordered rule list, allowing, dropping or rejecting it. A stateful firewall goes further and remembers the connections it has seen, so it can tell a reply to an outgoing request from an unsolicited arrival. An application-layer firewall or proxy inspects the content of the traffic itself. Firewalls may be network-based, guarding a whole network at its edge, or host-based, running on a single machine. The name is borrowed from the fire-resisting wall built between adjoining buildings, and the term entered network engineering in the 1980s as the Internet began to connect organisations that did not trust each other.

The item is a standard 'select the true statements' set with one obvious intruder, and the intruder — interconnecting telephones — is there to be discarded at once. What makes the question worth arguing is the temptation to treat statement 1 as too mechanical to count as a 'purpose'. It is worth resisting: a description of what a firewall does that leaves out inspection of arriving traffic has left out the whole method. Where a genuine distinction does matter is between a firewall and the things students confuse it with. Antivirus software scans files on a machine for malicious code; a firewall controls traffic at the boundary and does not, by itself, know whether a file is infected. A virtual private network encrypts traffic in transit but does not filter it. Intrusion detection watches and reports; a firewall acts. Keeping those four apart settles most questions in this family.

• A firewall monitors and controls incoming and outgoing network traffic according to configurable rules, and typically separates a trusted network from an untrusted one.
• Packet-filtering firewalls inspect header fields — addresses, protocol, port numbers — and match them against an ordered rule list.
• Stateful firewalls track connections, so they can distinguish a reply to an outgoing request from an unsolicited inbound packet.
• Firewalls are either network-based, guarding a network at its edge, or host-based, running on a single machine.
• Interconnecting telephone lines is the function of a private branch exchange, not of any firewall.

• Expecting a firewall to remove a virus. It controls traffic at the boundary; scanning files for malicious code is antivirus work.
• Reading a mechanism as though it were not a purpose. Inspecting arriving packets is how a firewall achieves everything else on the list.
• Being drawn by an option that contains the one absurd statement. Interconnecting telephones belongs to a switchboard, so any option carrying statement 4 can be dropped immediately.

As a select-the-true-statements item on the functions of a named security tool, with one absurd statement included as a filter, or as a single-line definition item.

• practice — not a real PYQ

  A firewall that keeps a record of established connections, so that it can distinguish a reply to an outgoing request from an unsolicited inbound packet, is best described as

  • (a)a stateless packet filter
  • (b)a stateful firewall
  • (c)an antivirus scanner
  • (d)a network switch

  Answer(b) a stateful firewall — a stateless filter judges each packet on its own header alone and cannot tell a reply from an unsolicited arrival.

• practice — not a real PYQ

  Which one of the following tasks is NOT performed by a firewall?

  • (a)Filtering traffic by port number
  • (b)Blocking connections from an untrusted address
  • (c)Removing a virus already present in a stored file
  • (d)Logging traffic that its rules have rejected

  Answer(c) Removing a virus already present in a stored file — that is antivirus work; a firewall governs traffic crossing the network boundary.