Question 9

Explanation

The firewall policy named "Internet_Access" is configured with the following settings:

• Incoming Interface: port2

• Outgoing Interface: port1

• Source: all

• Destination: all

• Schedule: always

• Service: DNS, FTP, HTTP, HTTPS

• Action: ACCEPT

• Inspection Mode: Flow-based

• NAT: Enabled

• IP Pool Configuration: Use Outgoing Interface Address

• Preserve Source Port: Disabled

• Protocol Options: default

• Security Profiles:

  • AntiVirus: default

  • Web Filter: Disabled

  • DNS Filter: Disabled

  • Application Control: Disabled

  • IPS: Disabled

  • File Filter: Disabled

• SSL Inspection: certificate-inspection

Given these settings, the correct answer to why the firewall policy would not block a well-known virus, such as EICAR, is:

D. The firewall policy does not apply deep content inspection.

The policy uses flow-based inspection mode, which does not provide as thorough an inspection of data packets as deep content inspection would. Although antivirus is enabled, without deep content inspection or complementary security profiles, the firewall might not effectively block well-known viruses.

Sure, let's analyze why the other options are incorrect:

A. The action on the firewall policy is not set to deny.

• The action on the firewall policy is indeed set to "ACCEPT," but this alone does not explain why a well-known virus would not be blocked. The firewall policy's action dictates whether traffic is allowed or blocked, but it doesn't impact the inspection level. Antivirus inspection should still be able to identify and block malicious content within allowed traffic.

B. The firewall policy is not configured in proxy-based inspection mode.

• While it's true that the policy is not in proxy-based inspection mode (it's in flow-based mode), the main difference here is the depth of inspection. Proxy-based mode provides more thorough content inspection, but this option alone does not fully capture why a virus would pass through. Option D addresses this better by highlighting the lack of deep content inspection specifically.

C. Web filter is not enabled on the firewall policy to complement the antivirus profile.

• The web filter's primary function is to block access to harmful or inappropriate websites, while the antivirus profile's job is to detect and prevent malicious content like viruses. While enabling web filter can enhance overall security, it's not the primary reason a well-known virus would not be blocked. The antivirus profile should be sufficient to block viruses, provided it performs deep content inspection.

In summary, D. The firewall policy does not apply deep content inspection is the best answer because it directly addresses the lack of thorough inspection, which is crucial for detecting well-known viruses. The other options either highlight settings that are not directly related to virus detection or do not fully address the depth of inspection required.