CISSP Communication and Network Security Practice Question
A security analyst is configuring a firewall to allow HTTP traffic (TCP port 80) from the internet to a web server in the DMZ. The firewall should also allow return traffic from the server back to the internet. Which type of firewall is best suited to handle this traffic while maintaining security?
⚠ Common exam trap
Many exam-takers choose packet filter firewalls (D) because they are simpler and can technically allow HTTP traffic on port 80, but they fail to recognize that stateful inspection is required to securely handle return traffic without manually creating complex, insecure rules for ephemeral ports.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Stateful inspection firewall
A stateful inspection firewall (C) is best suited because it tracks the state of active connections, allowing return traffic for established sessions (e.g., HTTP responses from the server to the internet) while blocking unsolicited inbound packets. It inspects packets at Layers 3 and 4, maintaining a state table that matches return packets to the original outbound request, ensuring only legitimate responses are permitted. This provides better security than a simple packet filter by preventing spoofed or out-of-context packets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Application proxy firewall
Why it's wrong here
An application proxy firewall terminates and re-establishes connections at Layer 7, inspecting HTTP payloads, which introduces latency and overhead unnecessary for simple stateful TCP port 80 traffic. It is tempting because it provides deep packet inspection for web protocols, making it the correct choice when filtering specific HTTP methods, URLs, or content is required, not merely permitting bidirectional TCP flows.
- ✗
Circuit-level gateway
Why it's wrong here
A circuit-level gateway operates at the session layer (Layer 5) of the OSI model, establishing a proxy connection between internal and external hosts. It validates the session itself but does not inspect the application-layer content, making it unsuitable for granular HTTP traffic control beyond simply relaying the TCP connection. While it can establish a 'circuit' for HTTP, it lacks the ability to understand or filter the actual web requests or responses, which is often a requirement when 'allowing HTTP' via a firewall.
- ✓
Stateful inspection firewall
Why this is correct
A stateful inspection firewall maintains a dynamic state table that tracks the context of active network connections, including TCP handshakes, sequence numbers, and connection direction. This allows it to automatically permit return traffic for established outbound connections, such as HTTP responses, without requiring explicit inbound rules for ephemeral ports. This capability significantly enhances security by only allowing expected return traffic and simplifies rule management for common protocols like HTTP.
- ✗
Packet filter firewall
Why it's wrong here
A packet filter firewall operates at the network and transport layers (Layers 3 and 4), inspecting individual packets in isolation based solely on header information like source/destination IP addresses and ports. Being stateless, it does not track the context of a connection, meaning separate, explicit rules are required for both outbound HTTP requests and their corresponding inbound responses. This often necessitates opening a broader range of high-numbered ephemeral ports for return traffic, which is less secure and more complex to manage than stateful inspection.
Visual reference
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.