Which three statements about firewalls are true? (Choose three.)
- A firewall can prevent undesired access to a network security zone.
- Firewalls typically provide protection between and within network security zones.
- A firewall can introduce a performance bottleneck.
- A firewall can act as an accelerator for business-critical data.
- If a system in a security zone is compromised, a firewall can help to contain the attack within that zone.
- Modern firewalls provide a complete network security solution.
Explanation: Firewalls are essential components of network security designed to enforce access control policies between different security domains. Their primary functions and limitations include:
- Access Control and Prevention: The fundamental job of a firewall is to classify traffic and decide what to forward or deny based on configured security policies. This allows them to prevent undesirable or unauthorized access to protected network security zones.
- Attack Containment: Similar to architectural firewalls in buildings, network firewalls are intended to contain damage. If a system within a specific zone is compromised, the firewall acts as a barrier to prevent the attack from spreading to other security zones.
- Performance Impact: Because firewalls are placed at critical transit points between zones and must inspect all passing traffic, they can introduce performance bottlenecks. It is necessary to size a firewall appropriately for the traffic volume it is expected to handle.
It is important to note that modern firewalls are not a complete security solution; they are merely one component of a larger security architecture. Additionally, they typically only provide protection between zones, as they generally cannot control traffic moving within the same security zone.
Related exam: Modules 14 – 16: Checkpoint Exam: Network Security Answers (CCNP ENCOR v9)
