ISC2 ISSAP Exam - Topic 5 Question 81 Discussion

Actual exam question for ISC2's ISSAP exam

Question #: 81
Topic #: 5

You work as a Chief Security Officer for Tech Perfect Inc. The company has a TCP/IP based network. You want to use a firewall that can track the state of active connections of the network and then determine which network packets are allowed to enter through the firewall. Which of the following firewalls has this feature?

AStateful packet inspection firewall

BProxy-based firewall

CDynamic packet-filtering firewall

DApplication gateway firewall

Show Suggested Answer

Suggested Answer: A

password to each application. In SSO, a user can access all computer applications and systems where he has access permission without

entering multiple passwords. This reduces human error and systems failure and is therefore highly desirable. There are many commercial SSO

solutions available in the market. Some of them are as follows:

Central Authentication Service (CAS)

The Dutch NREN

CoSign

Enterprise Single Sign-On (E-SSO)

Web Single Sign-On (Web SSO)

Security Assertion Markup Language (SAML)

Direct SSO

Shibboleth

Answer option B is incorrect. A one-time password (OTP) is a password only valid for a single login session or transaction. OTP avoids a

number of shortcomings that are associated with traditional passwords. The most important shortcoming that is addressed by OTP is that OTP

is not vulnerable to replay attacks. If a potential intruder manages to record an OTP that was already used to log into a service or to conduct

a transaction, he will not be able to abuse it since it will be no longer valid.

Answer option D is incorrect. Kerberos is a secure protocol that supports ticketing authentication. A ticket is granted in response to a client

computer authentication request by the Kerberos authentication server, if the request contains valid user credentials and a valid Service

Principal Name (SPN). The ticket is then used by the client computer to access network resources. To enable Kerberos authentication, the

client and server computers must have a trusted connection to the domain Key Distribution Center (KDC). The task of KDC is to distribute

shared secret keys to enable encryption.

Answer option C is incorrect. In the dynamic password authentication scheme, passwords are changed after a specified time or time interval.

by Virgie at Mar 08, 2024, 07:37 AM

Limited Time Offer

25%

Off

Get Premium ISSAP Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Gail

4 months ago

C sounds like it could work too, but A is the best choice.

upvoted 0 times

...

Ty

5 months ago

Surprised that people still confuse these types!

upvoted 0 times

...

Shantell

5 months ago

A is correct, it tracks active connections.

upvoted 0 times

...

Gilberto

5 months ago

I thought B was better for tracking connections?

upvoted 0 times

...

Andra

5 months ago

Definitely A, stateful packet inspection is the way to go!

upvoted 0 times

...

Erasmo

6 months ago

I feel like proxy-based firewalls are more about filtering traffic at the application layer, so I would lean towards A as well.

upvoted 0 times

...

Avery

6 months ago

I practiced a similar question where the focus was on connection states, and I think it pointed towards stateful firewalls too.

upvoted 0 times

...

Dorcas

6 months ago

I'm not entirely sure, but I think dynamic packet-filtering firewalls might also have some connection tracking features.

upvoted 0 times

...

Lera

6 months ago

I remember studying that stateful packet inspection firewalls keep track of active connections, so I think the answer is A.

upvoted 0 times

...

Dawne

6 months ago

The key is identifying the firewall that can monitor the state of network connections. Based on that, I think the stateful packet inspection firewall is the right answer.

upvoted 0 times

...

Joaquin

6 months ago

I'm a little confused by the technical terms used here. I'll need to review my notes on the different firewall architectures to make sure I understand the distinctions.

upvoted 0 times

...

Roselle

6 months ago

Okay, the question is asking about a firewall that can track active connections. That sounds like it's describing a stateful packet inspection firewall.

upvoted 0 times

...

Juliana

6 months ago

Hmm, I'm a bit unsure about the differences between these firewall types. I'll need to think through the key features of each one.

upvoted 0 times

...

Margot

6 months ago

This seems like a straightforward question on firewall types. I'm pretty confident I can identify the right option here.

upvoted 0 times

...

Nobuko

6 months ago

Hmm, this seems like a straightforward question about dispute resolution methods. I'll need to carefully consider the differences between the options to determine the best fit for box 7.

upvoted 0 times

...

Chantell

6 months ago

Hmm, I think the key here is figuring out how to best represent the donor's wealth information in the NPSP. The options seem to be focused on different ways to collect and rank that data.

upvoted 0 times

...

Berry

11 months ago

I'm voting for the stateful packet inspection firewall. It's the security equivalent of a parent keeping an eye on their kids' internet browsing history. Gotta love that level of parental control.

upvoted 0 times

Wilbert

9 months ago

I agree, it's like having a security guard monitoring the network traffic.

upvoted 0 times

...

Denae

10 months ago

A) Stateful packet inspection firewall

upvoted 0 times

...

Annalee

10 months ago

I see your point, but I prefer the stateful packet inspection firewall for better control.

upvoted 0 times

...

Maryrose

10 months ago

C) Dynamic packet-filtering firewall

upvoted 0 times

...

Glenn

10 months ago

That's a good choice. It's like having a watchful eye over the network.

upvoted 0 times

...

Tambra

10 months ago

A) Stateful packet inspection firewall

upvoted 0 times

...

Lashaun

11 months ago

Stateful packet inspection is the way to go! It's like having a bouncer at the door who knows all the regular guests and lets them in without a fuss. Gotta love that level of control.

upvoted 0 times

Fernanda

11 months ago

C) Dynamic packet-filtering firewall

upvoted 0 times

...

Miesha

11 months ago

Yes, stateful packet inspection is great for tracking active connections and allowing only authorized packets through.

upvoted 0 times

...

Brandon

11 months ago

A) Stateful packet inspection firewall

upvoted 0 times

...

Rose

12 months ago

Ah, the classic stateful firewall. I can almost hear the packets being inspected and the connections being monitored. It's like a security dance, but with more ones and zeros.

upvoted 0 times

Wilda

10 months ago

D) Application gateway firewall

upvoted 0 times

...

Kattie

10 months ago

C) Dynamic packet-filtering firewall

upvoted 0 times

...

Bok

10 months ago

B) Proxy-based firewall

upvoted 0 times

...

German

11 months ago

A) Stateful packet inspection firewall

upvoted 0 times

...

Kami

12 months ago

A stateful packet inspection firewall is definitely the answer here. It can track the state of active connections and make decisions based on that information. This is crucial for a robust network security strategy.

upvoted 0 times