Firewall types explained for Security+ (SY0-701)

Where firewall types fit on the Security+ blueprint

Firewalls show up in two SY0-701 domains: Security Architecture, which is Domain 3.0, and Security Operations, which is Domain 4.0. Architecture asks which type to deploy and where to place it. Operations asks how to write and tune the rules.

Objective 3.2 covers applying security principles to secure enterprise infrastructure, and that is where CompTIA lists the firewall types by name: web application firewall, unified threat management, next-generation firewall, and the Layer 4 versus Layer 7 distinction. Objective 4.5 sits in operations and covers modifying enterprise capabilities, including firewall rules, access control lists, and the ports and protocols you allow or block. So the same topic is tested twice from two angles, which is a good reason to actually understand each type rather than memorize a list. If you are still mapping out the full blueprint, our Security+ certification overview breaks the domains down by weight.

What is the difference between a stateless and a stateful firewall?

A stateless firewall checks each packet on its own against a set of rules. A stateful firewall remembers active connections, so it can tell a reply from an unsolicited packet. That memory is the whole difference.

A packet-filtering firewall is the classic stateless model. It reads the header of each packet and compares the source and destination IP address, the port, and the protocol against an access control list, or ACL. If a rule matches, the packet is allowed or dropped. This is fast and cheap, but it has no memory. It cannot tell whether an inbound packet is a legitimate response to something your network requested or a probe from an attacker, because it never tracked the original request.

A stateful inspection firewall closes that gap by keeping a state table of active sessions. When an internal host opens a connection, the firewall records it, then allows the matching return traffic automatically while still blocking anything unsolicited. Most modern firewalls are stateful at their core, and stateful inspection is the baseline that the fancier features are built on top of. For the exam, anchor on one idea: stateless means per-packet, stateful means per-connection.

What does a proxy or application-layer gateway actually do?

A proxy firewall, also called an application-layer gateway, sits between the client and the server and speaks the application protocol itself. Instead of just passing packets along, it rebuilds the request, which lets it inspect and filter content at Layer 7.

A forward proxy sits in front of your users and controls their outbound traffic, which is how many organizations enforce web filtering and hide internal addresses. A reverse proxy sits in front of your servers and handles inbound requests on their behalf. Because the proxy terminates the connection and starts a fresh one, the client and the real server never talk directly, which shrinks the attack surface the outside world can reach.

The tradeoff is performance and complexity. A proxy has to fully process each request at the application layer, so it works harder than a simple packet filter. In exchange, it can make decisions a lower-layer firewall cannot, such as blocking a specific URL path or stripping a dangerous header before it reaches the server. That Layer 7 awareness is also what connects proxies to the newer firewall types below.

What makes a next-generation firewall next-generation?

A next-generation firewall, or NGFW, is a stateful firewall with several security tools folded into one engine: deep packet inspection, application awareness, an intrusion prevention system, and often user identity. It inspects the payload, not just the header.

Deep packet inspection means the NGFW looks inside the packet at the actual data, not only the addressing in the header. Application awareness means it can recognize that traffic is, say, a file transfer or a specific web app even when it rides on a common port, so a rule can allow the app you want and block the one you do not. An integrated IPS lets it match traffic against known attack signatures and drop it inline. Identity awareness ties rules to users or groups from your directory rather than to bare IP addresses.

This is why an NGFW is a common building block in a modern, segmented design. When rules follow the user and the application instead of the address, you can enforce far tighter policy, which is one of the core ideas behind zero trust. On the exam, if a question mentions inspecting application traffic, blocking by app, or built-in intrusion prevention all in one appliance, it is pointing at an NGFW.

WAF and UTM solve two different problems

A web application firewall protects one thing, your web application, by filtering HTTP traffic at Layer 7. Unified threat management goes the other way and bundles many security functions into a single box. One is a specialist, one is a generalist.

A web application firewall sits in front of a web server and inspects HTTP and HTTPS requests for attacks aimed at the application logic, such as SQL injection and cross-site scripting. A traditional packet filter cannot catch these, because the malicious content lives inside a perfectly valid-looking web request. The WAF understands the request well enough to spot the attack pattern. If a scenario mentions protecting a website from injection or cross-site scripting, the answer is almost always WAF.

Unified threat management is the opposite idea. A UTM appliance combines a firewall with extras like intrusion prevention, antivirus, content filtering, spam filtering, and often a VPN, all managed from one console. It is popular with smaller organizations that want reasonable coverage without running a separate box for every function. The tradeoff is that one device now does everything, which can become a single point of failure and a performance bottleneck. NGFW versus UTM trips people up, so hold this line: an NGFW is firewall-first with deep inspection, while a UTM is a bundle of many tools where the firewall is just one of them.

Host-based or network-based, and which type goes where

Host-based firewalls run as software on a single device and protect just that machine. Network-based firewalls are appliances that guard a whole segment at a boundary. In practice you want both: one at the edge, one on each endpoint.

A host-based firewall, like the one built into Windows or the packet filter on a Linux server, travels with the device. That matters for a laptop that leaves the office and can no longer hide behind the corporate perimeter. A network-based firewall sits at a chokepoint, such as the boundary between your internal network and the internet, or between two internal security zones, and filters everything that crosses it. Defense in depth means using layers, so a packet reaching an endpoint has already passed the network firewall and still faces the host firewall. The fastest way to lock these in is to drill them as scenarios, which is exactly what Study mode is built for.

• Packet-filtering (stateless): filters on IP, port, and protocol from an ACL, with no connection memory. Fast but limited.
• Stateful inspection: tracks active connections in a state table and allows matching return traffic. The modern baseline.
• Proxy or application-layer gateway: terminates and rebuilds the connection at Layer 7 to inspect content. Forward proxy for users, reverse proxy for servers.
• Next-generation firewall (NGFW): stateful plus deep packet inspection, application awareness, IPS, and identity, in one engine.
• Web application firewall (WAF): Layer 7 defense for web apps against injection and cross-site scripting, sitting in front of the web server.
• Unified threat management (UTM): one appliance bundling firewall, IPS, antivirus, content and spam filtering, and often a VPN.
• Host-based vs network-based: host-based protects a single device and follows it, while network-based protects a segment at a boundary.

The one thing to remember about firewall types

If you strip firewall types down to a single question, it is this: at what layer does this device decide, and does it remember anything? Packet filters decide at Layers 3 and 4 with no memory. Stateful firewalls add connection memory. Proxies, NGFWs, and WAFs climb up to Layer 7 to read the actual content, each for a different reason. UTM is a bundle of tools, and host-based versus network-based is really about where the firewall lives. Get comfortable placing each type on that map and the SY0-701 questions stop being trivia and start being about design, which is exactly how CompTIA wants you to think. Practice a few scenarios, sketch where each firewall sits, and this becomes one of the easier topics on the exam.