AP Cybersecurity
AP Cybersecurity / All lessons / Unit 3: Securing Networks
3Unit 3: Securing Networks
AP Cybersecurity topic 3.4

Protecting Networks: Firewalls

A firewall checks traffic against an ordered list of rules and allows or blocks it based on source, destination, port, and protocol. Rules are usually checked top to bottom and the first match wins. Good firewalls end with "deny everything else" (implicit deny) and only open the ports a service truly needs.

Protecting Networks: Firewalls vocabulary

  • Firewall rule: A condition and an action (allow or deny) for matching traffic.
  • Port: A number that identifies a service, such as 443 for HTTPS or 22 for SSH.
  • Implicit deny: Blocking any traffic not explicitly allowed.
  • Stateful firewall: A firewall that tracks connections and allows replies to approved traffic.

AP-style practice questions

Try each one, then open the answer. To save your progress, take this quiz in the interactive course.

Skill: Mitigate Risk 
Rule  Action  Port  Source
1     Allow   80    ANY
2     Deny    443   10.8.0.0/16
3     Allow   443   ANY
4     Allow   22    10.8.4.20
5     Deny    ANY   ANY

1. A teacher at 10.8.3.15 cannot reach the school website over HTTPS (port 443). Which change would allow the teacher's access?

  1. (A) Swap rule 1 and rule 5
  2. (B) Swap rule 2 and rule 3
  3. (C) Delete rule 4
  4. (D) Move rule 5 to the top
Show answer

(B) Swap rule 2 and rule 3 Rules are checked top to bottom and the first match wins. Rule 2 denies 10.8.x.x before rule 3 can allow it. Swapping them lets rule 3 match first.

Skill: Analyze Risk

2. Using the same rules, what happens to a packet on port 3389 from 203.0.113.7?

  1. (A) It is allowed by rule 1
  2. (B) It is allowed by rule 3
  3. (C) It is denied by rule 5
  4. (D) It is allowed because no rule mentions port 3389
Show answer

(C) It is denied by rule 5 No earlier rule matches, so the final deny-all rule blocks it.

Skill: Mitigate Risk

3. Which of the following types of firewall tracks active connections and automatically allows reply traffic for connections started inside the network?

  1. (A) Packet-filtering (stateless) firewall
  2. (B) Stateful firewall
  3. (C) Host-based antivirus
  4. (D) Proxy server only
Show answer

(B) Stateful firewall A stateful firewall remembers connection state, so replies to approved requests are allowed.

Skill: Mitigate Risk

4. Where should a firewall be placed to protect an internal network from internet traffic?

  1. (A) Between the internal network and the internet connection
  2. (B) Inside a single employee's laptop only
  3. (C) Between the printer and the wall outlet
  4. (D) Behind the internal file server
Show answer

(A) Between the internal network and the internet connection A network firewall belongs at the boundary where outside traffic enters.

Open 3.4 in the interactive course