GATE CS 2011 Q.2 (CS Q.2): Application Layer: DNS, HTTP, SMTP, FTP

A layer-4 firewall (a device that can look at all protocol headers up to the transport layer) CANNOT

block entire HTTP traffic during 9:00PM and 5:00AM

block all ICMP traffic

stop incoming traffic from a specific IP address but allow outgoing traffic to the same IP address

block TCP traffic from a specific user on a multi-user system during 9:00PM and 5:00AM

Official answer and solution

Solution

Analyze the information visible to a layer-4 packet-filtering firewall.

A layer-4 firewall inspects headers up to transport layer protocols (TCP/UDP), including IP source and destination addresses, transport layer port numbers, protocol types (such as ICMP), and TCP flags.

Blocking HTTP traffic (destination port 80) based on time schedules (Option A), blocking ICMP packets (Option B), or statefully filtering traffic by IP address (Option C) are standard capabilities of a layer-4 firewall.

Operating system user accounts on a multi-user machine are not transmitted in IP or TCP headers. Therefore, a layer-4 firewall cannot associate packets with specific local users to block traffic on a per-user basis.

Final answer

The answer is the one in the official GATE answer key. The solution is this site's own explanation.

GATE questions are the work of the organising institutes. This site is independent and is not affiliated with them.