AP Cybersecurity Unit 3 Lesson 3 Exercise 1

Unit 3 • 3.3 • Exercise 1

Home›AP Cybersecurity›Unit 3 › 3.3 › Exercise 1

Exercise 1 — Firewall Rule Analysis

6 questions — Evaluate firewall configurations and packet filtering decisions

Score: 0 / 0 Predict the answer before selecting an option

Client Organization

Brightpath University

Brightpath University serves 15,000 students and 2,000 faculty across a main campus and two satellite locations. The campus network includes a student residence network, an academic research network with sensitive grant data, a public-facing web server cluster, and an administrative network handling financial aid and payroll. The IT security team is reviewing firewall policies after a recent audit flagged several misconfigurations.

Q1 Firewall Types

Brightpath’s perimeter firewall inspects each incoming packet’s source IP, destination IP, source port, destination port, and protocol type. It does NOT track whether the packet belongs to an established connection or examine the packet’s payload. This firewall is BEST classified as:

(A) A stateful inspection firewall that maintains a connection state table to track active sessions (B) A next-generation firewall (NGFW) that performs deep packet inspection and application-layer filtering (C) A stateless packet-filtering firewall that evaluates each packet independently based on header information (D) A web application firewall (WAF) that specifically protects HTTP/HTTPS traffic from injection attacks

The firewall examines header fields (IPs, ports, protocol) but does not track connection state or inspect payloads. This matches a stateless packet-filtering firewall, which evaluates each packet in isolation against its rule set.

(A) Incorrect — stateful firewalls track connection state; this firewall explicitly does not.

(B) Incorrect — NGFWs perform deep packet inspection of payloads; this firewall only examines headers.

(D) Incorrect — WAFs are application-layer devices focused on HTTP traffic; this operates at the network/transport layer.

Exam Tip: Stateless = examines each packet independently (headers only). Stateful = tracks connections. NGFW = adds application awareness and deep inspection.

Q2 Rule Order

The following firewall rules are applied in order:

Rule 1: ALLOW TCP from 10.0.0.0/8 to ANY on port 443
Rule 2: DENY TCP from 10.0.50.0/24 to 192.168.1.100 on port 443
Rule 3: DENY ALL

A packet arrives from 10.0.50.15 destined for 192.168.1.100 on port 443. What happens to this packet?

(A) The packet is denied by Rule 2 because it specifically blocks the 10.0.50.0/24 subnet from reaching that server (B) The packet is allowed by Rule 1 because 10.0.50.15 falls within the 10.0.0.0/8 range and Rule 1 is evaluated first (C) The packet is denied by Rule 3 because the default deny rule overrides all other rules (D) The packet is allowed because Rules 1 and 2 conflict, and the firewall defaults to allowing traffic when rules are ambiguous

Firewalls evaluate rules top-down and apply the first match. Rule 1 matches first because 10.0.50.15 is within the 10.0.0.0/8 range. Rule 2 never gets evaluated. This is a common misconfiguration — a broad ALLOW rule placed before a specific DENY rule renders the DENY rule useless.

(A) Incorrect — Rule 2 is never reached because Rule 1 already matches and is processed first.

(C) Incorrect — Rule 3 only applies to packets that do not match any earlier rule.

(D) Incorrect — firewalls do not default to allow on rule conflicts; they apply first-match logic.

Exam Tip: Firewall rule order matters. More specific rules must come BEFORE broader rules, or they will never be evaluated. This is a very common exam question format.

Q3 Stateful vs Stateless

A student in the residence hall initiates an HTTPS connection to an external website. The outbound SYN packet is allowed by the firewall. Later, the website sends a response packet back to the student. Which of the following statements about how different firewall types handle this return traffic are correct?

I. A stateless firewall would require a separate inbound rule explicitly allowing traffic from the website’s IP to the student’s IP on the ephemeral port.
II. A stateful firewall would automatically allow the return packet because it recognizes it as part of an established TCP session.
III. A next-generation firewall would block the return packet unless the website’s domain appears on an approved application allowlist.

(A) I only (B) II only (C) I and II only (D) I, II, and III

Statement I is correct — stateless firewalls evaluate each packet independently and cannot recognize return traffic as part of an existing session. Statement II is correct — stateful firewalls maintain a state table and automatically permit return packets for established connections. Statement III is incorrect — NGFWs include stateful tracking; they would allow the return packet as part of the established session regardless of application allowlists.

(A) Incomplete — Statement II is also correct.

(B) Incomplete — Statement I is also correct.

(D) Incorrect — Statement III misrepresents how NGFWs handle return traffic.

Exam Tip: Stateful firewalls solved the return-traffic problem. Without state tracking, administrators must create rules for both directions of every connection.

Q4 Default Deny

Brightpath’s firewall policy ends with an implicit DENY ALL rule. A new research lab needs access to an external genomics database on TCP port 8443. The IT team has not yet created a rule for this traffic. What will happen when a researcher tries to connect?

(A) The connection will succeed because port 8443 is a variant of HTTPS and is allowed by default on most firewalls (B) The firewall will prompt the researcher to request temporary access through a captive portal (C) The connection will be blocked because no explicit ALLOW rule exists and the default DENY rule rejects all unmatched traffic (D) The firewall will allow the first connection attempt and block subsequent ones until a rule is created

A default-deny (implicit deny) policy blocks all traffic that does not match an explicit ALLOW rule. This is the most secure baseline because it requires administrators to intentionally permit each type of traffic. The connection to port 8443 will fail until the IT team creates a specific rule allowing it.

(A) Incorrect — default-deny firewalls do not make exceptions based on port similarity to known services.

(B) Incorrect — standard firewalls do not generate user-facing prompts; they silently drop or reject packets.

(D) Incorrect — firewalls apply rules consistently to every packet; there is no “first attempt” exception.

Exam Tip: Default deny = everything is blocked unless explicitly allowed. Default allow = everything is permitted unless explicitly blocked. Default deny is the industry standard for security.

Q5 Firewall Limitations

A student downloads a malware-infected PDF from a legitimate academic journal website over HTTPS. Brightpath’s stateful firewall allowed the traffic because port 443 outbound is permitted. Which limitation does this scenario demonstrate?

(A) Stateful firewalls cannot inspect encrypted payload content, so malware transmitted inside HTTPS connections passes through undetected (B) Stateful firewalls cannot track TCP connection states, so they allowed the download without verifying it was part of a valid session (C) Stateful firewalls cannot filter traffic based on port numbers, so they allowed traffic on port 443 without evaluating it (D) Stateful firewalls cannot distinguish between inbound and outbound traffic, so they treated the download as an outbound request

Standard stateful firewalls operate at Layers 3-4 (network/transport). They can track connections and filter by IP/port, but they cannot inspect the encrypted payload inside an HTTPS session. Malware inside a legitimate HTTPS download passes through because the firewall sees only the encrypted tunnel, not the file contents.

(B) Incorrect — stateful firewalls specifically track connection states; that is their defining feature.

(C) Incorrect — all firewalls can filter by port number; this is a basic capability.

(D) Incorrect — firewalls clearly distinguish traffic direction; outbound rules are separate from inbound.

Exam Tip: Encryption is a double-edged sword: it protects user privacy but also hides malicious content from network-level inspection. This is why NGFWs with TLS inspection exist.

Q6 Practical Configuration

The IT team needs to allow faculty to access the administrative payroll system (192.168.10.5, port 8080) from the academic network (172.16.0.0/16) while blocking student access from the residence network (10.10.0.0/16). Which firewall rule set achieves this with CORRECT rule ordering?

(A) Rule 1: ALLOW from 172.16.0.0/16 to 192.168.10.5 port 8080
Rule 2: DENY from 10.10.0.0/16 to 192.168.10.5 port 8080
Rule 3: DENY ALL (B) Rule 1: DENY ALL
Rule 2: ALLOW from 172.16.0.0/16 to 192.168.10.5 port 8080
Rule 3: DENY from 10.10.0.0/16 to 192.168.10.5 port 8080 (C) Rule 1: ALLOW from ANY to 192.168.10.5 port 8080
Rule 2: DENY from 10.10.0.0/16 to 192.168.10.5 port 8080
Rule 3: DENY ALL (D) Rule 1: DENY from 10.10.0.0/16 to 192.168.10.5 port 8080
Rule 2: ALLOW from ANY to 192.168.10.5 port 8080
Rule 3: DENY ALL

Option A correctly places the specific ALLOW for faculty first, followed by the specific DENY for students, followed by the default DENY ALL. This ensures faculty can access the system, students cannot, and all other unmatched traffic is also blocked.

(B) Incorrect — Rule 1 (DENY ALL) blocks everything; Rules 2 and 3 are never evaluated.

(C) Incorrect — Rule 1 allows ANY source, which includes students. The student DENY in Rule 2 is never reached because Rule 1 already matched.

(D) Incorrect — Rule 2 allows ANY source after the student deny, which means any non-student IP (including guest, IoT, etc.) can access payroll.

Exam Tip: Build rules from most specific to least specific, ending with default deny. Test your rule set by tracing a packet from each source to verify correct behavior.

Questions Correct

Exercise 2 → Course Hub

← Lesson 3.3 Exercise 2 →

AP Cybersecurity Unit 3 • 3.3 • Exercise 1 | APCSExamPrep.com | Built by Tanner Crow, AP CS Teacher (11+ years)
AP® is a registered trademark of the College Board, which was not involved in the production of this content.

AP Cybersecurity · Unit 3 · Lesson 3.3 · Exercise 1

Lesson•Exercise 1•Exercise 2 →•Lab•Quiz

Back to:Lesson 3.3 Unit 3 Study Guide Course Guide

Get in Touch

Whether you're a student, parent, or teacher — I'd love to hear from you.

Just want free AP CS resources?

Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.

Typically responds within 24 hours

✓

Message Sent!

Thanks for reaching out. I'll get back to you within 24 hours.

Name *

Email *

I am a... (optional)

Which course? (optional)

Phone (optional)

How did you find us? (optional)

🏫 Welcome, fellow educator!

I offer curriculum resources, practice materials, and study guides designed for AP CS teachers. Let me know what you're looking for — whether it's classroom materials, a guest speaker, or Teachers Pay Teachers resources.

Message (optional — leave blank if just subscribing)

Send me free AP CS exam tips — daily practice questions, study resources, and exam strategies. + 20% OFF TUTORING
Unsubscribe anytime.

✉

[email protected]

📚

Courses

AP CSA, CSP, & Cybersecurity

⏱

Response Time

Within 24 hours

Prefer email? Reach me directly at [email protected]