Standard security management practice is to test security to confirm proper configuration, performance, and strength against attacks and exploits. When a firewall is updated or its settings modified, another round of firewall testing should be conducted.

Some approaches to firewall testing that do not disrupt the production environment are:

• Simulated firewall tests: Use an attack simulator to transmit attack packets to the firewall
• Virtual firewall tests: Are performed in a virtualized network environment using a virtualization tool
• Laboratory tests: Are run in nonproduction subnets on a duplicate of the production environment

Answer the following question(s):

Which approach do you think would be most effective? Why?