A network architect is evaluating whether to use a stateful inspection firewall or a next-generation firewall (NGFW) for a new deployment. What capability does an NGFW provide that a traditional stateful firewall lacks?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — an NGFW gives you application-layer identification, user-identity awareness, and integrated IPS above Layer 4, which a traditional stateful firewall doesn't provide. You're not just tracking connections anymore; you're seeing what apps and users are doing.
Full Explanation
The correct capability is application-layer identification, user-identity awareness, and integrated IPS capabilities operating above Layer 4. NGFWs operate at Layer 7, providing application identification (for example, distinguishing Dropbox from HTTP), user identity integration with directory services, and built-in IPS — capabilities a traditional stateful firewall lacks. The option about tracking TCP session state for connection management is wrong because stateful inspection firewalls already track TCP session state; this is not a differentiating feature of NGFWs. The option about support for NAT and PAT for address translation is wrong because NAT/PAT is supported by traditional stateful firewalls; it is not an NGFW-specific capability. The option about filtering traffic based on source and destination IP addresses and ports is wrong because IP and port-based filtering is basic firewall functionality predating NGFWs.