Cisco Interview Question

What are the differences between an exploit and a vulnerability? At which OSI layer does a firewall operate?