A layer-4 firewall (a device that can look at all protocol headers up to the transport layer) CANNOT (A) block entire HTTP traffic during 9:00PM and 5:00AM (B) block all ICMP traffic (C) stop incoming traffic from a specific IP address but allow outgoing traffic to the same IP address (D) block TCP traffic from a specific user on a multi-user system during 9:00PM and 5:00AM

A layer-4 firewall inspects headers up to Layer 4 (Transport Layer, such as TCP/UDP port numbers) and Layer 3 (IP addresses, ICMP types).

• (A) HTTP uses TCP port 80 (and 443 for HTTPS). A layer-4 firewall can block packets with destination/source port 80 based on time schedules.

• (B) ICMP operates at the network layer (Layer 3). A layer-4 firewall can inspect and block ICMP packets.

• (C) A stateful layer-4 firewall can inspect IP addresses and TCP state flags (like SYN) to distinguish and filter incoming connections while allowing outgoing connections.

• (D) User identification on a multi-user system belongs to the application/OS level. The transport layer packet headers only contain port numbers and IP addresses, not user identity or credentials. Thus, a layer-4 firewall cannot block traffic based on a specific user.

Therefore, the correct option is (D).