Firewalls, WAF, IDS, IPS, and Proxies

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Firewalls, WAF, IDS, IPS, and Proxies

Key Takeaways Explain This Topic AI

Firewalls enforce policy by address, port, protocol, connection state, application, user, or content depending on type.

A Web Application Firewall (WAF) inspects Layer 7 HTTP/HTTPS for injection, scripting, and traversal attacks; it does not replace secure coding.

An Intrusion Detection System (IDS) sits out of band and alerts; an Intrusion Prevention System (IPS) sits inline and can drop or reset traffic.

A forward proxy controls outbound users; a reverse proxy fronts and protects internal servers with TLS termination and load balancing.

Rule order, the implicit default deny, scoped source/destination, and logging are the most common SY0-701 firewall traps.

Last updated: June 2026

Reading the Scenario

SY0-701 tests network security devices by placement and function . Decide whether the scenario needs to allow, block, inspect, alert, proxy, or specifically protect a web application, then pick the device whose job matches that verb.

Control Comparison

Control Layer / focus Main purpose Typical placement
Packet-filtering firewall L3/L4, stateless Filter by IP, port, protocol Router ACL or boundary

Stateful firewall L4, tracks sessions Track connection state, allow return traffic Perimeter or segmentation point

Next-generation firewall (NGFW) L7, app/user aware Add application, user, and content inspection Edge or internal segmentation

WAF L7 HTTP/HTTPS Inspect web requests/responses Directly in front of web apps
IDS Detection Detect and alert Tap or SPAN port (out of band)
IPS Prevention Detect and block inline Inline in the traffic path
Forward proxy Egress Control user web access Between users and internet
Reverse proxy Ingress Front and protect servers Between clients and internal web
Firewall Rule Anatomy

Every rule should specify direction/interface, source, destination, service/port, action, logging, and order . Firewalls evaluate top-down and stop at the first match , so order is policy.

Order Source Destination Service Action
10 Internet Reverse proxy TCP 443 Allow/log
20 Reverse proxy Web app TCP 443 Allow/log
30 Web app Database TCP 5432 Allow/log
40 Internet Database Any Deny/log
99 Any Any Any Deny/log

Trap: an allow any/any placed above a deny makes the deny dead code. Specific allows go near the top; the broad logged deny anchors the bottom.

WAF Use Cases

Choose a WAF when the scenario mentions web-layer attacks:

SQL injection ( ' OR 1=1 -- ) in form or query parameters
Cross-site scripting ( <script> payloads)
Path or directory traversal ( ../../etc/passwd )
Malicious or oversized HTTP headers
Bot abuse or rate-limit evasion against an endpoint
Virtual patching : shielding a known vulnerability while developers fix code

A WAF is a compensating Layer 7 control, not a substitute for parameterized queries, input validation, patching, or authentication. SY0-701 distinguishes a WAF (web-specific) from a generic NGFW (broad app awareness).

IDS versus IPS

Feature IDS IPS
Traffic path Out of band (tap/SPAN) Inline
Primary action Alert Drop, reset, block, or alert
Failure concern Missed detection Blocking legitimate traffic (false positive impact)
Detection methods Signature, anomaly, behavior, heuristic Same methods, but acts in real time
Best exam clue "Detect without disrupting traffic" "Prevent malicious traffic in real time"

If the requirement is zero risk of dropping production packets, an IDS on a SPAN port is safer. If the requirement is to stop known exploits inline, an IPS is stronger. Both rely on signature (known patterns) and anomaly/behavioral (baseline deviation) detection.

Proxy Scenarios

Forward proxy (outbound): users connect to the proxy, which fetches internet resources and enforces URL filtering, malware scanning, authentication, and logging. Reverse proxy (inbound): external clients hit the proxy, which forwards to internal web services and can provide TLS termination, load balancing, authentication, caching, and server-detail hiding. Memory aid: forward protects users going out ; reverse protects servers being reached .

PBQ Rule-Fix

Current rules:

Order Source Destination Service Action
1 Any Any Any Allow
2 Internet Database Any Deny
3 Internet Web TCP 443 Allow

Rule 1 shadows everything below it, so the deny on rule 2 never fires. Fix: remove the broad allow, add scoped allows for required flows, add explicit denies for high-risk paths, and close with a final logged default deny. The SY0-701 maxim: specific allows above broad denies, and never let a broad allow defeat the policy.

Firewall Generations in Depth

The exam expects you to rank firewall capability by generation:

Packet filter: examines each packet independently against source/destination IP, port, and protocol. Fast and stateless, but it cannot tell a legitimate return packet from a forged one and is easy to evade with crafted flags.

Stateful inspection: maintains a state table of established sessions, so it permits return traffic for connections it saw initiated and drops unsolicited packets. This is the baseline for most perimeters.

Next-generation firewall (NGFW): adds deep packet inspection, application identification (it can allow general web traffic but block a specific app), user-identity awareness from the directory, integrated IPS, and TLS inspection.

Unified Threat Management (UTM): bundles firewall, IPS, antivirus, content filtering, and VPN into one appliance, convenient for smaller sites but a single point of failure.

Inspection Modes and Failure Behavior

Know the failure stance terms. Fail-open keeps traffic flowing if the device fails, favoring availability; fail-closed (fail-secure) stops traffic, favoring confidentiality. An inline IPS that fails closed protects the network but can cause an outage, so high-availability designs pair inline devices or use bypass logic. TLS inspection (a man-in-the-middle break-and-inspect) lets an NGFW or WAF see inside encrypted sessions, but it requires distributing the inspection certificate to clients and can break certificate-pinned applications.

The recurring SY0-701 theme: match the device generation and its fail stance to whether the business prioritizes availability or strict blocking, and never assume a stateless filter sees what an NGFW or WAF sees.