A layer-4 firewall (a device that can look at all protocol headers up to the…
2011
A layer-4 firewall (a device that can look at all protocol headers up to the transport layer) CANNOT
Answer: D. block TCP traffic from a specific user on a multi-user system during 9:00PM to 5:00AM — Key insight: a layer-4 firewall can inspect up to transport-layer headers (IP addresses, ports, TCP/UDP, protocol) but cannot see application payloads or map…
- A.
block entire HTTP traffic during 9:00PM and 5:00AM
- B.
block all ICMP traffic
- C.
stop incoming traffic from specific IP address but allow outgoing traffic to the same IP address
- D.
block TCP traffic from a specific user on a multi-user system during 9:00PM to 5:00AM
Attempted by 131 students.
Show answer & explanation
Correct answer: D
Key insight: a layer-4 firewall can inspect up to transport-layer headers (IP addresses, ports, TCP/UDP, protocol) but cannot see application payloads or map packets to OS-level user accounts.
Can do: block traffic by protocol/port (for example, block HTTP by blocking TCP port 80) and apply time-based rules.
Can do: block specific protocol types such as ICMP.
Can do: create direction-based rules (for example, deny new incoming connections from an IP while allowing outgoing connections to that same IP); stateful behavior must be considered for return traffic.
Cannot do: enforce policies tied to a specific OS user on a multi-user host, because user identity is not visible in transport-layer headers.
Therefore the statement that a layer-4 firewall cannot block TCP traffic from a specific user on a multi-user system during 9:00PM to 5:00AM is correct. Per-user enforcement requires application-layer inspection, an authenticated proxy, or host-based controls.
A video solution is available for this question — log in and enroll to watch it.