If a firewall has to drop packets because it cannot keep up with traffic volume, this is ________.

• A. Good because it will prevent possible attack packets from entering the network
• B. Bad because valid, non-attack packets will be dropped and this will effectively create a self-generated DOS attack
• C. Both A and B
• D. Neither A nor B

Answer: (C)

When a firewall can’t keep up with traffic, it must drop some packets. That creates a dual effect: it can stop or slow attack traffic, which is good, but it also blocks legitimate, non-attack packets, which harms normal users and services. In other words, the same behavior that can filter out bad traffic can also cause a denial of service for valid traffic. Because of this mixed outcome, both of the described consequences are true: it helps reduce harmful traffic while simultaneously causing a self-inflicted service disruption. This situation also signals under-provisioning or the need for better traffic management, such as capacity upgrades, rate limiting, or more advanced defenses to separate attack traffic from legitimate traffic without harming normal users.