A next-generation firewall sits at the edge of a company’s connection to the Internet. A network engineer has configured it to prevent Telnet clients residing on the Internet from accessing Telnet servers inside the company. Which of the following might a next-generation firewall use that a traditional firewall would not?

(A) Match message destination well-known port 23
(B) Match message application data
(C) Match message IP protocol 23
(D) Match message source TCP ports lower than 5400

Match message application data is the correct answer.

Traditional and next-generation firewalls can check TCP and UDP port numbers, but next-generation firewalls are being able to also check application data beyond the Transport layer header. A next-generation firewall (NGFW) would look into the application data, identifying messages that contain data structures used by Telnet, instead of matching with port numbers. In other words, a next-generation firewall (NGFW) is defined as a deep-packet inspection firewall that moves beyond port/protocol inspection and blocking to add application-level inspection, intrusion prevention, and bringing intelligence from outside the firewall.