Layer 7 firewalls use which technique to identify applications or protocols?

• A. Deep packet inspection
• B. Port filtering
• C. NAT
• D. IP filtering

Answer: (A)

Layer 7 firewalls identify applications or protocols by inspecting the data inside the packets to determine what application is generating the traffic. This technique, deep packet inspection, analyzes the payload and uses protocol signatures and traffic behavior to classify traffic beyond just port numbers. That lets the firewall enforce policies based on the actual application, even if the traffic uses nonstandard ports or looks generic at the header level. In contrast, port filtering checks only the port numbers (layer 4), NAT handles address translation, and IP filtering looks at header fields without inspecting the payload.