During a security test, after an external DoS attack, an FTP session from an external IP to the internal network succeeds. What happened to the firewall?

• A. The firewall failed-open
• B. The firewall failed-closed
• C. The firewall ACL has been purged
• D. The firewall failed-bypass

Answer: (A)

The test hinges on how firewalls behave when they fail. If a firewall fails-open, it stops filtering and lets traffic pass as if there were no barrier at all. Seeing an FTP session from an external IP into the internal network succeed after an external DoS attack fits this scenario: the firewall didn’t block the connection as it should, so traffic got through. A fail-closed state would block such traffic, so the session wouldn’t succeed. Purging ACLs could also lead to less filtering, but the key point here is the device’s failure mode during the DoS event, which is best described as failing open. A failed-bypass would imply a separate bypass mechanism rather than a general open state caused by a fault.