The primary function of a firewall is to monitor and control incoming and outgoing network traffic based on predefined security rules. Firewalls enforce boundaries between trusted and untrusted networks and may allow, block, or log traffic depending on source, destination, protocol, port, application, or policy. Not all firewalls inspect traffic up to the application layer; that depends on firewall type and configuration. Firewalls do not merely transmit data through physical media; that is a network device function. Firewalls also do not automatically encrypt data transfer; encryption is provided by protocols such as VPN, TLS, or IPsec. Internal auditors should review firewall rules, change control, logging, exceptions, and periodic rule recertification. Therefore, Option C is correct.