The first types of firewalls were packet filtering firewalls. It is the most basic firewall making access decisions based on ACL's. It will filter traffic based on source IP and port as well as destination IP and port. It does not understand the context of the communication and inspects every single packet one by one without understanding the context of the connection. "Second generation firewall" is incorrect. The second generation of firewall were Proxy based firewalls. Under proxy based firewall you have Application Level Proxy and also the Circuit-level proxy firewall. The application level proxy is very smart and understand the inner structure of the protocol itself. The Circui-Level Proxy is a generic proxy that allow you to proxy protocols for which you do not have an Application Level Proxy. This is better than allowing a direct connection to the net. Today a great example of this would be the SOCKS protocol.
"Third generation firewall" is incorrect. The third generation firewall is the Stateful Inspection firewall. This type of firewall makes use of a state table to maintain the context of connections being established. "Fourth generation firewall" is incorrect. The fourth generation firewall is the dynamic packet filtering firewall.
References: CBK, p. 464 AIO3, pp. 482 - 484
Neither CBK or AIO3 use the generation terminology for firewall types but you will encounter it frequently as a practicing security professional. See http://www.cisco.com/univercd/cc/td/doc/product/iaabu/centri4/user/scf4ch3.htm for a general discussion of the different generations.

Section: Security Architecture and Engineering

Explanation
Section: Security Assessment and Testing

Explanation/Reference:
Explanation:
IPSec Tunnel mode works at the Internet layer, not at the Transport layer.
Incorrect Answers:
A: In IPSec tunnel mode, the entire IP packet is encrypted and/or authenticated.
C: In tunnel mode, the entire IP packet is encrypted and/or authenticated. It is then encapsulated into a new IP packet with a new IP header. That is, in tunnel mode, there are two sets of IP headers.
D: Tunnel mode is used to create virtual private networks for network-to-network communications (e.g.
between routers to link sites), host-to-network communications (e.g. remote user access or for gateway services) and host-to-host communications.
References:
https://en.wikipedia.org/wiki/IPsec#Tunnel_mode