Firewalls
Segmentation drew the boundaries. Firewalls guard them — checking every packet against an ordered rulebook and deciding, in order, what gets through.
A firewall is software that allows or denies traffic in and out of a network, running on a standalone device or built into a router. Its rulebook is an access control list (ACL): a set of rules checked in order, where the first rule that matches wins.
That ordering is the whole game. A well-built ACL allows exactly the traffic the network needs and denies everything else by default — least privilege, enforced packet by packet, at every boundary worth defending.
Filter the Traffic
Stateless, stateful, and next-generation firewalls inspect packets at increasing depth.
3.4.A · TypesOrder the Rules
An ACL is checked top to bottom; the first matching rule executes — so order decides outcomes.
3.4.B · ACLPlace the Firewalls
Put a firewall at every internet ingress/egress point and at each segment boundary.
3.4.C · PlacementTwo networks, one job. At Mercy Valley Hospital, Firewall A must let the public reach the web server while Firewall B keeps patient records on the internal file server off-limits to outsiders. Aboard the submarine, each segment boundary needs its own firewall. You'll write the rules and decide where the firewalls go.
AP Learning Objectives
- 3.4.AIdentify types of network-based firewalls.
- 3.4.BExplain how a firewall uses an access control list to allow or deny traffic entering or leaving a network.
- 3.4.CDetermine the effective placement of firewalls in a network.
- 3.4.DConfigure a firewall to manage the flow of network traffic.
A firewall doesn't "understand" intent — it mechanically applies rules in order and acts on the first match. So the security lives in the rules and their order: allow what's needed, deny everything else, and put the firewall wherever traffic crosses a boundary.
What you'll be able to do: distinguish firewall types, read ACL rule anatomy, sort rules by direction, evaluate traffic against an ordered ACL, design a DMZ, place firewalls effectively, and build a correctly ordered rule set.
Types, Rules & the Order That Decides
Three firewall types, one rule structure, and the first-match logic that makes order everything.
A stateless firewall does packet filtering — it judges each packet on header info alone: IP addresses, ports, and protocols. A stateful firewall (dynamic packet filtering) goes further, tracking the state of connections so it can apply connection-related rules for more control. A next-generation firewall (NGFW) has both, plus advanced features like intrusion prevention, deep packet inspection, and filtering by application type.
All of them run an ACL. Each rule names a direction (inbound or outbound), a criterion (IP, port, service, or application), and an action (permit or deny). The firewall checks rules in order and executes the first match. A final default-deny rule catches everything not explicitly allowed — the heart of least privilege.
Diagram · Firewall traffic decision flow
Diagram · ACL rule evaluation order
Inbound vs Outbound Rule Sorter
Lab · ClassifyEvery ACL rule has a direction. Select each rule and drop it under Inbound or Outbound.
Inbound
Traffic entering the network
Outbound
Traffic leaving the network
Concept Check
30 secAn ACL reads: 1) ALLOW inbound TCP 22 then 2) DENY inbound TCP ALL. If you move the DENY rule to the top, what happens to SSH (port 22)?
Firewall Types & DMZ Terms
The three firewall types and the architecture terms behind effective placement.
| Type | What it does |
|---|---|
| Stateless (packet filtering) | Filters on packet-header info — IP addresses, ports, protocols. |
| Stateful (dynamic packet filtering) | Tracks connection state, adding connection-related rules for more control. |
| Next-generation (NGFW) | Stateless + stateful plus intrusion prevention, deep packet inspection, and app-type filtering. |
| Term | Meaning |
|---|---|
| Access control list (ACL) | The ordered set of permit/deny rules a firewall applies to inbound and outbound traffic. |
| Rule anatomy | Direction (inbound/outbound) + criterion (IP, port, service, application) + action (permit/deny). |
| First match wins | Rules are checked in order; the first matching rule executes and the search stops. |
| Default deny | A final rule that denies anything not explicitly allowed. |
| Least privilege | Allow only the traffic that is genuinely needed; deny the rest. |
| DMZ (screened subnet) | A lower-security zone for public-facing resources, between external and internal networks. |
| External vs internal firewall | External guards the internet boundary; internal guards the private network behind the DMZ. |
DMZ Decision Lab
Lab · 5 decisionsDesign the hospital's DMZ. Firewall A faces the internet; Firewall B faces the internal network. Make the secure call.
What the Exam Rewards
This topic is Mitigate Risk — skills 2.C (evaluate the impact of a control) and 2.D (implement and log mitigations).
Rule order is testable. The exam loves the SSH example: ALLOW 22 then DENY all permits SSH; reverse them and SSH is blocked too. Always trace top-to-bottom.
Placement is testable. A firewall belongs at every internet ingress/egress point and at each segment boundary — not just one perimeter device.
Common MCQ traps
"All matching rules are applied."
Only the first matching rule executes; the firewall stops searching after it.
"A stateless firewall tracks connections."
That's a stateful firewall. Stateless filters only on packet-header info.
"One perimeter firewall is enough."
Each segment and each ingress/egress point should have its own firewall.
Analyst note — Mercy Valley: Firewall A permits inbound HTTPS to the DMZ web server and denies the rest; Firewall B denies all inbound traffic from the DMZ to the internal file server except authenticated staff requests. Two firewalls, two rule sets, set independently — that's effective placement plus least privilege.
Allow / Deny Traffic Simulator
Lab · 5 packetsA firewall is loaded with the ACL below. For each arriving packet, predict whether the firewall permits or denies it.
| # | Loaded ACL (checked in order) |
|---|---|
| 1 | ALLOW inbound TCP port 22 from ALL |
| 2 | ALLOW inbound TCP port 443 to web server |
| 3 | DENY inbound TCP from ALL (default deny) |
Build a Correctly Ordered ACL
The rule-review console. Order the rules so SSH and web traffic are allowed and everything else is denied — then evaluate.
ACL Rule Builder
Lab · Configure (2.D)Goal: allow inbound SSH (port 22) and HTTPS to the web server (port 443), and deny all other inbound TCP. Click the rules into the order the firewall should check them, then evaluate.
Available rules
Your ACL (evaluated top to bottom)
Misconceptions That Cost Points
Each is a planted wrong answer. Learn to see the trap.
"Rule order doesn't matter if the rules are correct."
Order is everything — a DENY-all placed above an ALLOW will block the traffic you meant to permit.
"Default deny blocks legitimate traffic, so skip it."
Default deny is the safety net of least privilege — explicitly allow what's needed, then deny the rest.
"An NGFW is just a faster stateless firewall."
An NGFW adds intrusion prevention, deep packet inspection, and app-type filtering on top of stateful.
"Put the public web server on the internal network."
Public-facing resources belong in the DMZ, separated from internal systems by a second firewall.
"A firewall on the router covers the whole network."
Each segment needs its own firewall so traffic in and out of that segment is controlled.
"Firewalls only inspect inbound traffic."
ACLs govern both inbound and outbound traffic — exfiltration is controlled on the way out.
DMZ Architecture & Placement
The two-firewall DMZ picture, plus two labs: mark every spot that needs a firewall, then reason through placement scenarios.
Diagram · DMZ architecture
Firewall Placement Map
Lab · PlaceClick every boundary that should have a firewall. A boundary is any point where traffic crosses between the internet, the DMZ, or a segment — not a link inside a single segment.
Effective Firewall Placement Challenge
Lab · 5 scenariosReason through each placement scenario across the hospital and submarine networks.
Prove the Rulebook
Five AP-style questions with instant feedback, then a snapshot to lock it in.
Mini AP-Style Quiz
Lab · 5 questionsChoose one answer per question, then submit for scored feedback with explanations.
Five Takeaways
Three types. Stateless (packet filtering), stateful (tracks connections), NGFW (adds IPS, DPI, app filtering).
ACL = ordered rules. Each names direction, criterion, and action; the firewall executes the first match.
Order changes outcomes. A DENY-all above an ALLOW blocks the very traffic you wanted to permit.
Default deny + least privilege. Allow only what's needed; deny everything else at the end.
Place everywhere it counts. A firewall at each internet ingress/egress and each segment boundary; DMZ for public resources.
Final AP exam tip: when given an ACL, trace each packet top-to-bottom and stop at the first match. When asked about placement, say a firewall belongs at every internet boundary and segment edge — and put public-facing resources in a DMZ behind their own firewall.
One mistake to avoid: don't forget the default-deny at the bottom. Without it, anything your rules didn't explicitly handle could slip through.
Practice — attempt these now.
AP-style assessments aligned to this lesson. Time them.