Free HCIA-Security V4.0 Exam Practice Questions

Explanation From HCIA-Security documents:

In the TCP/IP and OSI reference models, the transport layer is responsible for end-to-end communication between hosts. It provides services such as segmentation, multiplexing through port numbers, and (depending on the protocol) reliability, flow control, and congestion control. The two core transport layer protocols are TCP and UDP.

TCP is connection-oriented and reliable: it establishes a session using the three-way handshake, uses sequence numbers and acknowledgments for retransmission, and supports flow and congestion control to ensure ordered delivery. UDP is connectionless and best-effort: it does not build a session or guarantee delivery, which makes it lightweight and suitable for scenarios such as voice/video streaming and simple query/response services.

By contrast, FTP and DHCP are application layer protocols. FTP provides file transfer services and runs over TCP ports, while DHCP provides dynamic IP address assignment and uses UDP at the transport layer but is itself an application-layer protocol. Therefore, the transport-layer protocols in the options are UDP and TCP.

Explanation From HCIA-Security documents:

A packet filtering firewall mainly makes decisions based on L3/L4 header information such as source/destination IP address, protocol, and port, usually through static ACL rules . Because it does not deeply understand application behavior and typically does not track full session state like a stateful inspection firewall, it has several limitations.

A is a disadvantage because basic packet filtering is often implemented as rule-by-rule matching; under heavy traffic or intentionally flooded traffic, performance can degrade and the device may be pressured by DoS-style loads, especially if rules are long or the platform is resource-limited.

B is also a disadvantage: packet filtering that trusts only IP information can be bypassed by IP spoofing in certain scenarios, allowing traffic to appear as if it comes from an allowed address.

C is correct because packet filtering relies on static policies , which struggle to handle dynamic connections, complex services, and fine-grained user-based control.

D is not a disadvantage of packet filtering; dynamic connection status lists are a feature of stateful firewalls, not simple packet filters.