Free Palo Alto Networks Cybersecurity-Apprentice Actual Exam Questions - Question 14 Discussion
implementing a Next-Generation Firewall (NGFW). Which of the following features best distinguishes an
NGFW from a traditional firewall?
B. I agree with the points on D not being unique—stateful inspection has been around a while. Also, A and C are pretty basic firewall stuff, nothing new. The real difference with NGFWs is the ability to do deep packet inspection, which means they look beyond just headers and ports, actually checking the content for threats. That’s why B stands out as the defining feature here.
It’s B because stateful inspection (D) is standard for most firewalls now, so it’s not unique. The real game-changer with NGFWs is looking inside the packets to spot threats, which only DPI does.
I also think A and C can be dropped since static IP whitelisting and basic packet filtering are pretty old-school features. The main difference really comes down to the ability to inspect inside the packet payload, which points to B. Could there be any scenario where D is considered enough?
B/D? DPI (B) is the big thing NGFWs add, but stateful inspection (D) is also important even in older firewalls. Still, DPI lets you see inside packets, not just headers, so it’s more unique to NGFWs.
Probably B. Deep packet inspection sets NGFWs apart from old-school firewalls.