In addition to source and destination address and port information, stateful firewalls use a state flag to identify the current status of a connection. Which of the following possible state values indicates that the third step in the three-way handshake has been completed and a connection between two hosts has been created? SYN_RECV ESTABLISHED FIN_WAIT1 CLOSED

Why VPN is a good solution to implement in a firewall. If the computer being accessed does not implement it, why not implement it in the actual server(s) themselves?

Which of these would be a filtering mechanism found in a firewall rule? All of these direction protocol source address

Which of the following services does a firewall do that is regarded as its most important?What are the best practices for employing packet-filtering software, and what are the criteria for doing so?

Remember that TCP/IP's transport stage reassembly and reordering packets. Internet or data layer firewalls may be used if needed. Stateful inspection firewalls cannot detect damaged or missing communication streams.

How can an attacker with host access (either an untrustworthy host, or an attacker who has compromised the host.  This is also known as a host attack) attack a system that uses passwords to authenticate users, and which stores the passwords in plain text?

Can you please help with these questions: What is the difference in detail captured between NetFlow, firewall logs, and raw packet captures?   Which would be more useful in investigating malware?   Which types of network logs/capture would take more storage space?   What kinds of things could firewall and NetFlow logs be useful for over raw packet captures?.