Firewalls - Interview Questions & Answers

A Firewall is the first line of defense in network security. It monitors, filters, and controls incoming and outgoing network traffic based on predefined security rules.

Every enterprise system—whether hosted on-premises, AWS, Azure, GCP, or Kubernetes—uses firewalls to protect applications, APIs, databases, and internal services.

---

Q1. What is a Firewall?

Answer

A Firewall is a network security device or software that allows or blocks network traffic based on configured security rules.

Its primary goals are:

• Prevent unauthorized access
• Allow trusted communication
• Block malicious traffic
• Protect internal networks

Firewall Overview

flowchart LR
A[Internet] --> B[Firewall] --> C[Application Server] --> D[Database]

---

Q2. Why is a Firewall important?

Answer

Without a firewall:

• Anyone can access your server.
• Attackers can scan open ports.
• Malware can reach internal systems.
• Sensitive services become publicly accessible.

Protected Network

flowchart TD
A[Internet] --> B[Firewall] --> C[Load Balancer] --> D[Application] --> E[Database]

Benefits

• Blocks unauthorized users
• Reduces attack surface
• Improves network security
• Supports compliance

---

Q3. How does a Firewall work?

Answer

A firewall inspects every incoming and outgoing packet and compares it against configured rules.

Typical checks include:

• Source IP
• Destination IP
• Port Number
• Protocol
• Network Direction

Packet Inspection

flowchart TD
A[Incoming Packet] --> B[Firewall Rules] --> C{Allowed?}

C -->|Yes| D[Forward Traffic]

C -->|No| E[Block Traffic]

---

Q4. What are the different types of Firewalls?

Answer

There are several types of firewalls used in enterprise environments.

Firewall Type	Purpose
Packet Filtering Firewall	Filters packets based on IP, Port, Protocol
Stateful Firewall	Tracks connection state
Proxy Firewall	Acts as an intermediary
Next-Generation Firewall (NGFW)	Deep packet inspection and application awareness
Cloud Firewall	Protects cloud resources

Firewall Types

flowchart TD
A[Firewalls]

A --> B[Packet Filtering]

A --> C[Stateful]

A --> D[Proxy]

A --> E[NGFW]

A --> F[Cloud Firewall]

---

Q5. What is a Stateful Firewall?

Answer

A Stateful Firewall remembers active network connections and makes decisions based on the connection state.

Unlike packet filtering firewalls, it understands whether traffic belongs to an existing trusted session.

Stateful Inspection

flowchart LR
A[Client] --> B[Firewall]

B --> C[Connection Table]

C --> D[Application]

Benefits

• Better security
• Faster processing for established connections
• Prevents unauthorized packets

---

Q6. What is the difference between a Firewall and a Web Application Firewall (WAF)?

Answer

Firewall	WAF
Protects Network	Protects Web Applications
Layer 3 & Layer 4	Layer 7
Blocks ports and IPs	Blocks HTTP attacks
Filters packets	Filters web requests

Comparison

flowchart TD
A[Internet] --> B[Firewall] --> C[Web Application Firewall] --> D[Spring Boot Application]

Firewall Protects

• Network

WAF Protects

• SQL Injection
• Cross-Site Scripting (XSS)
• CSRF
• HTTP-based attacks

---

Q7. Where should Firewalls be placed in an enterprise architecture?

Answer

Firewalls are deployed at multiple layers.

Enterprise Deployment

flowchart TD
A[Internet] --> B[Perimeter Firewall] --> C[Load Balancer] --> D[Web Application Firewall] --> E[API Gateway] --> F[Application Servers] --> G[Database Firewall]

Firewall Locations

• Internet Edge
• DMZ
• Internal Network
• Database Layer
• Cloud VPC

---

Q8. What are common Firewall rules?

Answer

Examples of firewall rules include:

• Allow HTTPS (443)
• Allow SSH only from trusted IPs
• Block Telnet (23)
• Block unknown ports
• Allow internal database traffic only
• Deny all other traffic by default

Example Rule Flow

flowchart TD
A[Incoming Request] --> B[Firewall]

B -->|Port 443| C[Allow]

B -->|Port 22 Trusted IP| D[Allow]

B -->|Unknown Port| E[Block]

Best Practice

Follow the default deny principle—allow only the traffic that is explicitly required.

---

Q9. What are common Firewall misconfigurations?

Answer

Common mistakes include:

• Opening all ports
• Allowing 0.0.0.0/0 unnecessarily
• Exposing databases to the internet
• Weak outbound rules
• Missing logging
• Not reviewing rules periodically
• Overly permissive security groups

Wrong Design

Internet

↓

Database ❌

Correct Design

Internet

↓

Firewall

↓

Application

↓

Database ✅

---

Q10. What are the enterprise best practices for Firewalls?

Answer

Follow these best practices:

• Apply the Principle of Least Privilege.
• Allow only required ports.
• Block unused services.
• Use stateful inspection.
• Deploy WAF for web applications.
• Enable firewall logging.
• Review firewall rules regularly.
• Segment internal networks.
• Use cloud-native firewalls and security groups.
• Continuously monitor suspicious traffic.

Enterprise Firewall Architecture

flowchart TD
A[Users] --> B[Internet] --> C[Perimeter Firewall] --> D[Web Application Firewall] --> E[API Gateway] --> F[Spring Boot Microservices] --> G[Internal Firewall] --> H[Database]

Defense in Depth

flowchart LR
A[Firewall] --> B[WAF] --> C[API Gateway] --> D[Authentication] --> E[Authorization] --> F[Application]

Firewall Security Checklist

mindmap
  root((Firewall Best Practices))
    Least Privilege
    Default Deny
    Stateful Inspection
    Logging
    Rule Reviews
    WAF
    Network Segmentation
    Secure Ports
    Cloud Firewalls
    Monitoring

Senior Interview Tip

In modern enterprise systems, a firewall alone is not enough.

A production-ready architecture combines:

• Perimeter Firewall
• Internal Firewalls
• Web Application Firewall (WAF)
• API Gateway
• TLS 1.3
• OAuth2 & JWT
• Network Segmentation
• IDS/IPS
• Zero Trust Architecture
• SIEM Monitoring

Think of a firewall as the first security checkpoint, while application security, authentication, authorization, and monitoring provide additional layers of protection.

---

Quick Revision

• A Firewall filters network traffic.
• Firewalls allow or block traffic based on security rules.
• Stateful Firewalls track active connections.
• WAF protects web applications from HTTP attacks.
• Deploy firewalls at multiple network layers.
• Allow only required ports.
• Follow the default deny principle.
• Enable logging and monitoring.
• Review firewall rules regularly.
• Combine firewalls with WAF, API Gateways, and Zero Trust Architecture.