diff --git a/105-firewall-review-quiz.el b/105-firewall-review-quiz.el
new file mode 100644
index 0000000..f37309f
--- /dev/null
+++ b/105-firewall-review-quiz.el
@@ -0,0 +1,112 @@
+;;; 105-firewall-review-quiz.el --- firewall-review-quiz
+;;;
+;;; Review firewall ACLs, stateful behavior, firewalld, UFW, and IDS.
+;;;
+;;; This file is part of the Linux+ Learning project.
+;;;
+;;; Copyright (c) 2026, Scott C. MacCallum (scm@sdf.org).
+;;;
+;;;    This program is free software: you can redistribute it and/or modify
+;;;    it under the terms of the GNU Affero General Public License as
+;;;    published by the Free Software Foundation, either version 3 of the
+;;;    License, or (at your option) any later version.
+;;;
+;;;    This program is distributed in the hope that it will be useful,
+;;;    but WITHOUT ANY WARRANTY; without even the implied warranty of
+;;;    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;;    GNU Affero General Public License for more details.
+;;;
+;;;    You should have received a copy of the GNU Affero General
+;;;    Public License along with this program.  If not, see
+;;;    <https://www.gnu.org/licenses/>.
+
+(defun linuxplus-firewall-review-quiz ()
+  "Quiz for Linux+ firewall review."
+  (interactive)
+
+  (linuxplus-start-quiz
+   'linuxplus-firewall-review-lesson
+
+   '((:type true-false
+      :prompt "Firewalls use ACLs."
+      :answer true)
+
+     (:type true-false
+      :prompt "Firewalls inspect network packets."
+      :answer true)
+
+     (:type true-false
+      :prompt "Firewall configuration files help rules persist."
+      :answer true)
+
+     (:type true-false
+      :prompt "ACL means access control list."
+      :answer true)
+
+     (:type true-false
+      :prompt "A firewall ACL can allow or deny traffic."
+      :answer true)
+
+     (:type true-false
+      :prompt "A stateless firewall tracks connection state."
+      :answer false)
+
+     (:type true-false
+      :prompt "A stateful firewall tracks connection state."
+      :answer true)
+
+     (:type true-false
+      :prompt "A stateful firewall can be faster for established traffic."
+      :answer true)
+
+     (:type true-false
+      :prompt "A stateful firewall can help identify fragmented packets."
+      :answer true)
+
+     (:type true-false
+      :prompt "firewalld has runtime and permanent configuration."
+      :answer true)
+
+     (:type true-false
+      :prompt "sudo firewall-cmd --runtime-to-permanent saves runtime rules."
+      :answer true)
+
+     (:type true-false
+      :prompt "sudo ufw status numbered shows numbered UFW rules."
+      :answer true)
+
+     (:type true-false
+      :prompt "sudo ufw deny 22/tcp blocks SSH using simple UFW syntax."
+      :answer true)
+
+     (:type true-false
+      :prompt "Port 22/tcp is commonly associated with SSH."
+      :answer true)
+
+     (:type true-false
+      :prompt "sudo ufw allow 22/tcp blocks SSH traffic."
+      :answer false)
+
+     (:type yes-no
+      :prompt "For this book item, are DenyHosts and Fail2Ban IDS tools?"
+      :answer yes)
+
+     (:type yes-no
+      :prompt "For this book item, should you remember /etc/hosts.deny?"
+      :answer yes)
+
+     (:type true-false
+      :prompt "DenyHosts is strongly associated with /etc/hosts.deny."
+      :answer true)
+
+     (:type true-false
+      :prompt "Fail2Ban commonly blocks through firewall actions."
+      :answer true)
+
+     (:type true-false
+      :prompt "For the book question, memorize the expected wording."
+      :answer true))
+
+   "*Linux+ Firewall Review Quiz*"))
+
+;;; 105-firewall-review-quiz.el ends here