Software Firewalls and Malware Defense on the Workstation

A software firewall is a program running on an individual computer that filters network traffic entering and leaving that one host, allowing or blocking connections based on rules about apps, ports, and network profiles. On Windows workstations this role is filled by Windows Defender Firewall, which is on by default and is the first suspect whenever a freshly installed application can’t be reached over the network. This article covers the workstation-level defense layer the 220-1202 exam expects you to know: the host firewall, common malware types like keyloggers, and cleaning up adware that abuses Windows notifications.

What a software firewall does

The distinguishing word is host-based. A network (hardware) firewall — the one built into a small office/home office (SOHO) router, configured as part of SOHO router hardening — protects everything behind it as traffic crosses the network edge. A software firewall protects only the machine it’s installed on, but it sees something the router never can: which application is generating or receiving the traffic. That lets it enforce rules like “Spotify may accept inbound connections, this unknown executable may not.”

Its primary function is filtering inbound and outbound traffic on that single host according to rule sets. It is not an antivirus engine, it doesn’t scan files for signatures, and it doesn’t remove malware — it controls network conversations. The two tools are complementary layers: anti-malware watches what runs on disk and in memory; the firewall watches what talks on the wire.

Attribute	Network (hardware) firewall	Software (host-based) firewall
Where it runs	Router/appliance at the network edge	On each individual computer
What it protects	All devices behind it	Only that host
Sees application context	No — ports and addresses only	Yes — per-app allow/block rules
Protects against LAN-side threats	No (traffic never crosses it)	Yes — filters peer-to-peer LAN traffic
Typical A+ example	SOHO router firewall	Windows Defender Firewall

That LAN-side row matters: if another machine on the same network is infected, the router firewall never sees the attack, but each workstation’s own firewall still can. This is why you leave Windows Defender Firewall enabled even behind a router.

The classic symptom: “nobody can connect to the new app”

Here is the scenario every technician eventually lives: you install a line-of-business application that acts as a server — a database front end, a scanning service, a license manager — and it works fine locally, but other computers can’t connect to it. Before blaming the network, DNS, or the app vendor, check the host firewall on the machine running the app. Windows Defender Firewall blocks unsolicited inbound connections by default; a new service listening on a new port is exactly what that default exists to stop.

The fix is an exception, not a shutdown: open Windows Defender Firewall > Allow an app or feature through Windows Defender Firewall (or create an inbound rule in Windows Defender Firewall with Advanced Security for a specific port) and allow the application on the appropriate network profile. Disabling the firewall entirely “to make it work” trades one ticket for a security hole and is never the credited answer. Note that the profile matters — a rule allowed on Private networks won’t help if the network interface card (NIC) is classified as Public; see Windows Network Profiles and Client Connections for how profiles change firewall behavior.

Remember the direction logic: default-deny applies to inbound traffic; outbound traffic is generally allowed by default. So a workstation can usually browse the web out of the box, but can’t host anything until you say so.

Know your malware: the keylogger and its relatives

The exam’s malware-identification questions reward matching one defining behavior to one name. The keylogger’s signature behavior: it silently records every keystroke — usernames, passwords, messages — and forwards the log to an attacker. Keyloggers can be software (often bundled inside a trojan) or tiny hardware devices inline with the keyboard cable. Because they capture credentials at the source, they defeat even strong passwords; multifactor authentication and anti-malware scanning are the practical countermeasures.

Keep the neighbors straight by their one-line behaviors:

• Spyware — the umbrella category: covertly collects user activity data. A keylogger is the keystroke-specific member of this family.
• Trojan — malware disguised as a legitimate program that the user installs voluntarily; often the delivery vehicle for keyloggers and remote-access tools.
• Ransomware — encrypts data and demands payment; loud by design, the opposite of a keylogger’s stealth.
• Rootkit — hides deep in the OS to conceal other malware and itself from detection tools.
• Adware / potentially unwanted programs (PUPs) — bombard the user with advertising; annoying and often bundled with “free” downloads.

Workstation defense is layered: keep the OS patched, run real-time anti-malware with current definitions, keep the software firewall on, work from a standard (non-administrator) account, and train users not to install unsolicited software. When prevention fails, follow the structured cleanup process in Malware Removal and System Restore.

Adware in the notification area

A modern nuisance pattern: a user sees a steady stream of Windows toast notifications — the pop-ups sliding in from the corner above the notification area — advertising products, fake virus warnings, or “your PC is at risk” scareware, even when no browser is open. Because the pop-ups render through the operating system’s own notification system, an installed app (or a browser that granted a spam site notification permission) is pushing them.

The efficient first move is Settings > System > Notifications (Notifications & actions on some builds). That page lists every app allowed to send notifications, so you can identify the offender by name and switch its toggle off — which both stops the symptom and tells you what to uninstall or scan for next. Chasing individual pop-ups, reinstalling the browser, or jumping straight to a reimage skips the diagnostic step that names the culprit. If the source turns out to be a website’s notification permission rather than an installed program, remove that permission in the browser’s site settings and clear the leftover site data while you’re in there — clearing browser cache, cookies, and site data covers when and why.

How the 220-1202 exam tests this

• A definition question asking the primary function of a software firewall on a workstation — the credited answer centers on filtering inbound/outbound traffic on that single host, with antivirus-style behaviors as distractors.
• A scenario where a newly installed application can’t be reached from other computers, asking the MOST likely first thing to check — the host firewall blocking inbound connections, fixed with an app exception rather than by disabling the firewall.
• A behavior-to-name malware match: silent keystroke capture forwarded to an attacker means keylogger, not spyware-in-general, trojan, or rootkit.
• A troubleshooting scenario with ad pop-ups appearing via Windows notifications outside the browser, asking which Settings area identifies and blocks the sending app — the Notifications page under Settings > System.

Each of these stems trades on one distinction — drill it with practice questions until firewall, antivirus, and notification-spam answers stop blurring together.

Quick reference

• Software firewall = host-based, per-machine, per-application traffic filtering; hardware firewall = edge protection for the whole LAN.
• Windows Defender Firewall blocks unsolicited inbound connections by default; outbound is generally allowed.
• New server-style app unreachable from other PCs? Check the host firewall first and add an allow rule — never disable the firewall as a fix.
• Firewall rules are per network profile; a Private-profile exception does nothing on a Public-profile connection.
• Keylogger = records keystrokes and exfiltrates them; it’s the keystroke-specific form of spyware, often delivered by a trojan.
• Anti-malware and firewalls are complementary layers — one inspects code and behavior, the other controls network conversations.
• OS toast notifications pushing ads point to an app or site permission: identify and block it in Settings > System > Notifications.
• Least privilege applies at the desk: daily work in a standard account limits what any malware can do.