In host-based firewalls, what does granularity refer to?

• A. Filtering only by IP address.
• B. The ability to apply control and filtering on a per-process basis.
• C. Filtering only by port number.
• D. Filtering by user login only.

Answer: (B)

Granularity here means how finely the firewall can tailor its rules. A host-based firewall that can apply control on a per-process basis can evaluate and block or allow traffic based on which application is running, not just where the traffic is going or coming from. This level of specificity lets you restrict network access for individual programs, limiting potential damage if one process is compromised or behaving unexpectedly, while other processes continue to operate normally.

Filtering by IP address or by port number, while common, affects traffic at a coarser level—it's about where traffic is coming from or going to, or what protocol is used—without regard to which application initiated it. Filtering by user login adds another dimension, but it’s still less granular than tying decisions to a specific process. Therefore, the ability to apply control on a per-process basis best captures the concept of granularity in a host-based firewall.