CISSP Communication and Network Security Practice Question
Which type of firewall is capable of inspecting application-layer data, performing SSL decryption, and integrating intrusion prevention capabilities?
⚠ Common exam trap
Test-takers frequently confuse an application proxy firewall with an NGFW, but the key differentiator is that an NGFW integrates SSL decryption and IPS into a single engine, whereas a proxy firewall typically handles only specific application protocols without inline threat prevention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Next-generation firewall
A next-generation firewall (NGFW) goes beyond traditional stateful inspection by incorporating deep packet inspection (DPI) of application-layer data, the ability to decrypt and inspect SSL/TLS traffic, and integrated intrusion prevention system (IPS) capabilities. This convergence allows NGFWs to identify and block threats within encrypted sessions and enforce policies based on application identity rather than just ports and protocols.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Packet filter firewall
Why it's wrong here
A packet filter firewall operates at the network and transport layers (OSI Layers 3 and 4), making decisions based solely on header information such as source/destination IP addresses, port numbers, and protocol types. It examines individual packets in isolation without understanding the context of a connection or the content within the data payload. Consequently, it lacks the ability to inspect application-layer protocols or the actual data being transmitted by applications.
- ✓
Next-generation firewall
Why this is correct
A Next-generation firewall (NGFW) is specifically engineered to perform deep packet inspection up to Layer 7 (application layer) of the OSI model, providing comprehensive application awareness and control. It integrates advanced security features such as intrusion prevention systems (IPS), SSL/TLS decryption, and user identity awareness. This allows NGFWs to identify, classify, and control specific applications and their content, regardless of the port or protocol they use, effectively inspecting application-level traffic for threats and policy violations.
- ✗
Application proxy firewall
Why it's wrong here
An application proxy firewall, also known as a gateway firewall, functions at the application layer by acting as an intermediary for specific application protocols like HTTP or FTP. It terminates the client connection, inspects the application-level data, and then establishes a new connection to the server. While it effectively inspects application data for predefined protocols, its capabilities are often limited to those specific applications and it typically does not include the broad, integrated security services such as full SSL decryption or advanced intrusion prevention systems that are standard in NGFWs.
- ✗
Stateful firewall
Why it's wrong here
A stateful firewall maintains a state table to track the status of active network connections, allowing it to permit legitimate return traffic for established sessions based on source/destination IP addresses and port numbers. While it provides enhanced security over packet filters by understanding connection context, its inspection capabilities are primarily confined to Layer 3 and Layer 4 headers. It does not analyze the actual content within the data payload or understand application-layer protocols, thus it cannot inspect application data.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
IPS
An Intrusion Prevention System (IPS) is a network security device that monitors traffic in real time and automatically blocks threats before they reach your systems.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.