The statement 'If a firewall receives a packet that is suspicious, it will drop and log the packet' is:

• A. True
• B. False
• C. Not enough information
• D. Depends on policy

Answer: (B)

Firewalls act based on configured policy, so the action taken on a packet deemed suspicious isn’t fixed. A policy might specify to drop and log such packets, to drop them silently, to log only, or to allow with an alert. Logging and dropping are separate decisions that can be combined in some policies but not required in others. Because there isn’t a universal rule that all suspicious packets must be dropped and logged, the statement isn’t universally true; the behavior depends on the policy in place.