Pregunta de entrevista de Cisco

What are the differences between an exploit and a vulnerability? At which OSI layer does a firewall operate?