Palo Alto Networks (PANW) Certified Network Security Administrator (PCNSA) Practice Exam

What technique can be performed by a next-generation firewall but NOT by a legacy firewall?

1. Filtering traffic based on source IP

2. Inspecting HTTP data streams

3. Blocking traffic on certain ports

4. Network address translation

The correct answer is: Inspecting HTTP data streams

Next-generation firewalls (NGFWs) are designed to provide advanced security features that go beyond the capabilities of legacy firewalls, particularly when it comes to application-layer inspection. Inspecting HTTP data streams involves analyzing the content and context of the web traffic, allowing the firewall to identify specific applications, users, and potential security threats such as malware, data leaks, or unauthorized access attempts. Unlike legacy firewalls, which primarily operate at the network and transport layers, focusing on IP addresses and ports, NGFWs can perform deep packet inspection and analyze the actual data being transmitted. This capability enables them to enforce security policies based on the specific applications in use, rather than just the basic characteristics of the traffic. As a result, they can take actions like blocking or allowing traffic based on application-level identifiers, which greatly enhances the security posture of the network. Thus, the ability to inspect HTTP data streams represents a significant functionality that only next-generation firewalls can perform, differentiating them from legacy firewalls.