Firewalls, WAF, IDS, IPS, and Proxies

Reading the Scenario

SY0-701 tests network security devices by placement and function. Decide whether the scenario needs to allow, block, inspect, alert, proxy, or specifically protect a web application, then pick the device whose job matches that verb.

Control Comparison

Firewall Rule Anatomy

Every rule should specify direction/interface, source, destination, service/port, action, logging, and order. Firewalls evaluate top-down and stop at the first match, so order is policy.

Trap: an allow any/any placed above a deny makes the deny dead code. Specific allows go near the top; the broad logged deny anchors the bottom.

WAF Use Cases

Choose a WAF when the scenario mentions web-layer attacks:

• SQL injection (' OR 1=1 --) in form or query parameters
• Cross-site scripting (<script> payloads)
• Path or directory traversal (../../etc/passwd)
• Malicious or oversized HTTP headers
• Bot abuse or rate-limit evasion against an endpoint
• Virtual patching: shielding a known vulnerability while developers fix code

A WAF is a compensating Layer 7 control, not a substitute for parameterized queries, input validation, patching, or authentication. SY0-701 distinguishes a WAF (web-specific) from a generic NGFW (broad app awareness).

IDS versus IPS

If the requirement is zero risk of dropping production packets, an IDS on a SPAN port is safer. If the requirement is to stop known exploits inline, an IPS is stronger. Both rely on signature (known patterns) and anomaly/behavioral (baseline deviation) detection.

Proxy Scenarios

Forward proxy (outbound): users connect to the proxy, which fetches internet resources and enforces URL filtering, malware scanning, authentication, and logging. Reverse proxy (inbound): external clients hit the proxy, which forwards to internal web services and can provide TLS termination, load balancing, authentication, caching, and server-detail hiding. Memory aid: forward protects users going out; reverse protects servers being reached.

PBQ Rule-Fix

Current rules:

Rule 1 shadows everything below it, so the deny on rule 2 never fires. Fix: remove the broad allow, add scoped allows for required flows, add explicit denies for high-risk paths, and close with a final logged default deny. The SY0-701 maxim: specific allows above broad denies, and never let a broad allow defeat the policy.

Firewall Generations in Depth

The exam expects you to rank firewall capability by generation:

• Packet filter: examines each packet independently against source/destination IP, port, and protocol. Fast and stateless, but it cannot tell a legitimate return packet from a forged one and is easy to evade with crafted flags.
• Stateful inspection: maintains a state table of established sessions, so it permits return traffic for connections it saw initiated and drops unsolicited packets. This is the baseline for most perimeters.
• Next-generation firewall (NGFW): adds deep packet inspection, application identification (it can allow general web traffic but block a specific app), user-identity awareness from the directory, integrated IPS, and TLS inspection.
• Unified Threat Management (UTM): bundles firewall, IPS, antivirus, content filtering, and VPN into one appliance, convenient for smaller sites but a single point of failure.

Inspection Modes and Failure Behavior

Know the failure stance terms. Fail-open keeps traffic flowing if the device fails, favoring availability; fail-closed (fail-secure) stops traffic, favoring confidentiality. An inline IPS that fails closed protects the network but can cause an outage, so high-availability designs pair inline devices or use bypass logic. TLS inspection (a man-in-the-middle break-and-inspect) lets an NGFW or WAF see inside encrypted sessions, but it requires distributing the inspection certificate to clients and can break certificate-pinned applications.

The recurring SY0-701 theme: match the device generation and its fail stance to whether the business prioritizes availability or strict blocking, and never assume a stateless filter sees what an NGFW or WAF sees.