Which of the following threats is least effectively controlled by a…

Concept

A traditional network firewall is an enforcement point between networks with different trust levels. It observes traffic that crosses that point and applies rules based on attributes such as addresses, ports, protocols, connection state, and supported inspection data.

Its protection is therefore strongest when a relevant flow crosses the firewall and is distinguishable by policy. Activity that stays inside the trusted environment, or that uses already-authorized access in an apparently permitted way, requires additional identity, data, and behaviour controls.

Application

An authorized internal user already has legitimate access and begins inside the protected environment. Data misuse may occur between internal systems without crossing the perimeter, and an outbound transfer may resemble a permitted session unless content-aware or behaviour-aware controls inspect it.

Contrast

• Unauthorized port access exposes a destination port and protocol that a firewall ruleset can allow or deny.

• Malicious inbound traffic reaches the network through the perimeter, where filtering or supported inspection can act on it.

• External intrusion attempts create untrusted-to-trusted connection attempts that access-control and stateful rules can reject.

• Unauthorized external network access also crosses the enforcement boundary before reaching an internal resource.

Cross-check

NIST describes network firewalls as controls over traffic flowing between networks and notes that traffic sent between internal hosts may not pass through a network firewall. Insider misuse is instead addressed with controls such as least privilege, data loss prevention, logging, and user-activity or behaviour monitoring.

Result

Thus, among the offered threats, data theft by authorized internal users is least effectively controlled by a traditional hardware firewall.