CertiGuide to Security+  9  Chapter 3:  Infrastructure Security (Domain 3.0; 20%)

3.5.3.9.2  Databases 1 2 3 4 5 6 7 8 9 10 3.7  Success Questions

Firewalls

You discovered more details about firewalls, which come in two types, application-level and network level:

• Application-level firewalls, or proxy servers, act as middlemen between client and server sides of a connection, keeping two separate physical connections open for each single logical conversation, and passing packets as permitted. Pros include finer-grained control over permissions due to proxy’s detailed knowledge of each protocol allowed to pass through the firewall, and the fact that internal systems are usually protected from most low-level TCP/IP attacks, because the proxy never allows an external system to connect directly to the internal system. Cons include that client configuration is usually required, and they are less efficient than other types of firewalls due to overhead in setting up multiple connections for each incoming request.
  
  
• Network-level firewalls inspect packets as they travel through the firewall, from one side (the outside network) to the other (the inside network). Pros include transparency to network clients and faster speed/more efficiency compared to application-level firewalls. Cons include no isolation from low-level TCP/IP attacks since direct connections from outside devices to inside devices are allowed, and less protocol specific filtering functionality than many application firewalls. Two types of network-level firewalls are packet filters and stateful packet inspection firewalls. Packet filters are the simplest, lowest-overhead firewall; they base all decisions as to allow or disallow a packet based on the contents of that packet, not taking into account the context of the conversation. Stateful packet inspection firewalls build on packet filter technology by looking at packets in the context of the conversation in which they occur, giving them more information to evaluate when deciding whether or not to allow a packet through.

3.5.3.9.2  Databases 1 2 3 4 5 6 7 8 9 10 3.7  Success Questions