Firewalls, appliances and selecting the control that fits

Objective 3.2 in this course covers enterprise infrastructure. The previous lesson took placement and zones; this one takes the appliances themselves and the act of choosing between two that both technically work.

Why this matters

The appliance questions on this exam are rarely "what is a firewall". They are "here is a requirement, which of these four devices meets it" — and the four options are usually all real security devices, three of which solve a different problem.

The discriminator is almost always what layer the device understands. A device that only sees addresses and ports cannot make a decision about a URL, and a device that inspects HTTP cannot protect a database protocol it has never heard of.

The lesson

Next-generation firewall, WAF, UTM, layer 4 versus layer 7

Start with the layer distinction, because everything else follows from it.

• A layer 4 firewall makes decisions on source and destination address, port and protocol. A stateful one also tracks connection state, so it knows a returning packet belongs to a connection someone inside started. It is fast and it cannot tell one HTTPS conversation from another.
• A layer 7 device understands the application protocol — HTTP methods and paths, SQL statements, DNS queries. It can act on content rather than on endpoints.

The named devices:

• Next-generation firewall (NGFW) — stateful firewall plus application awareness (it identifies the application regardless of port), user identity integration, intrusion prevention and often TLS inspection. This is the general-purpose perimeter and internal boundary device.
• Web application firewall (WAF) — sits in front of web applications and inspects HTTP/HTTPS specifically, blocking injection, traversal and application-layer abuse. It is narrow and deep: excellent for web, irrelevant for anything else. It is also the standard virtual patch for a web vulnerability that cannot be fixed immediately.
• Unified threat management (UTM) — one appliance combining firewall, antivirus, content filtering, anti-spam and IDS/IPS. The value is simplicity and cost for smaller organisations; the costs are that it is a single point of failure and each function is typically weaker than a dedicated product.

The exam's separator: NGFW protects the network and understands many applications; WAF protects a web application and understands one protocol deeply. If the scenario says SQL injection or cross-site scripting against a web app, the answer is a WAF.

Jump server, proxy server, IPS/IDS placement and load balancer

• A jump server (bastion host) is a hardened, heavily monitored host that is the only system permitted to reach a sensitive zone. Administrators connect to it and from there to the targets. Its value is that administrative access is funnelled through one auditable point, and the targets accept management connections from one address. It must be hardened aggressively, because compromising it grants exactly what it was built to control.
• A proxy server sits between clients and destinations. A forward proxy serves internal users going out — it enforces filtering, provides caching and makes outbound traffic inspectable, and it means internal hosts have no direct internet route, which is itself a significant control. A reverse proxy serves external users coming in — it terminates TLS, hides the origin server, and is where a WAF usually lives.
• IDS and IPS detect known-bad activity. The placement rule is from the previous lesson: IPS inline, IDS on a tap. Placing a sensor outside the perimeter firewall shows you what is being attempted; inside shows you what got through, which is the more actionable of the two.
• A load balancer distributes traffic across several servers. It is an availability control first, and it has security roles: TLS termination, health checks that remove a failed node, absorbing some volumetric load, and — with session persistence — a place where application session handling can go wrong if misconfigured.

Sensors, and what they can see from where you put them

A sensor is anything that collects — a network tap feed, an endpoint agent, a log forwarder, a cloud flow log.

The rule that matters: a sensor's visibility is a property of its position, and most monitoring gaps are position problems rather than tooling problems.

• A network sensor sees only traffic that crosses its segment. East-west traffic between two hosts on the same VLAN never passes the gateway, so a sensor at the gateway is blind to lateral movement — which is precisely the activity you most want to see.
• A sensor that receives only encrypted traffic sees metadata: who talked to whom, how much, how often, for how long. That is genuinely useful (it is how beaconing is found) and it will not show you content.
• An endpoint sensor sees what happens on the host regardless of encryption, and sees nothing about devices that cannot run an agent — which is the IoT, OT and unmanaged device problem from the previous lesson.
• A cloud sensor sees what the provider exposes, and only if logging was enabled before the event.

The practical conclusion, and a good exam instinct: combine network and endpoint telemetry, because each is blind exactly where the other sees.

Port security, 802.1X and EAP

These control what may connect to the network at all, which is the earliest possible place to stop an unauthorised device.

• Port security on a switch limits which MAC addresses may use a port, and how many. It is simple and it is weak on its own, because MAC addresses are trivially spoofed — an attacker who can observe one legitimate address can present it.
• 802.1X is port-based network access control done properly. Before a device gets any network access, it must authenticate. Three roles to know: the supplicant (the device), the authenticator (the switch or access point, which passes messages through), and the authentication server (usually RADIUS, which makes the decision).
• EAP is the framework 802.1X carries. The variants worth recognising: EAP-TLS, which uses certificates on both sides and is the strongest; PEAP and EAP-TTLS, which build a TLS tunnel and then authenticate the user inside it, commonly with a password; and EAP-FAST. If a question asks for the strongest wireless or wired authentication, EAP-TLS is the answer, and the cost it names is certificate management.

802.1X is also the enforcement mechanism behind network access control, which you meet in Domain 4: authenticate the device, check its posture, and place it on the right VLAN — or a remediation VLAN — based on the result.

Choosing between two controls that both technically work

The selection questions have a method. Four things decide it:

1. What layer is the threat at? Address and port → firewall. HTTP content → WAF. DNS name → DNS filtering. File content → sandbox or gateway antivirus. Behaviour on a host → EDR.
2. Must it block, or only tell you? Blocking means inline and means accepting the availability risk and the false positive cost. If the scenario stresses that business traffic must not be interrupted, the answer is detection first.
3. Can it see what it needs to see? Encrypted traffic, east-west traffic and agentless devices each rule out whole categories of control.
4. What is the operational cost, and will it be paid? An allow list, TLS inspection and 802.1X are all strong and all demand ongoing work. A control the organisation cannot run is not a control.

A worked example of the shape the exam uses: "Staff are reaching malicious sites. We must block them, we cannot decrypt traffic for privacy reasons, and the solution must work for remote laptops." No decryption rules out content inspection. Remote laptops rule out anything at the office perimeter. Blocking by name before the connection is made points to DNS filtering, delivered by an agent or a cloud resolver. That is the answer, and the reasoning is elimination rather than recall.

One more general principle the exam rewards: prefer the control that removes the exposure over the one that watches it, and prefer defence in depth — two or three imperfect controls in series usually beats one perfect-sounding control, because no single device sees everything.

What to take into the exam

• Layer 4 sees addresses and ports; layer 7 sees content. Match the device to the layer the threat lives at.
• SQL injection or XSS against a web app → WAF. Application identification and general boundary control → NGFW.
• A jump server funnels administrative access through one auditable, hardened point.
• Forward proxy for users going out, reverse proxy for users coming in; the WAF usually lives with the reverse proxy.
• A gateway sensor is blind to east-west traffic, which is where lateral movement happens — pair network and endpoint telemetry.
• 802.1X roles: supplicant, authenticator, authentication server. EAP-TLS is the strongest and costs certificate management.