156-215.80 · Question #168
UDP packets are delivered if they are ___________.
The correct answer is B. a valid response to an allowed request on the inverse UDP ports and IP. Although UDP is connectionless, Check Point's stateful inspection engine accepts return UDP packets only when they match the inverse IP addresses and ports of a previously allowed outbound UDP request.
Question
UDP packets are delivered if they are ___________.
Options
- Areferenced in the SAM related dynamic tables
- Ba valid response to an allowed request on the inverse UDP ports and IP
- Ca stateful ACK to a valid SYN-SYN/ACK on the inverse UDP ports and IP
- Dbypassing the kernel by the forwarding layer of ClusterXL
How the community answered
(17 responses)- B82% (14)
- C12% (2)
- D6% (1)
Why each option
Although UDP is connectionless, Check Point's stateful inspection engine accepts return UDP packets only when they match the inverse IP addresses and ports of a previously allowed outbound UDP request.
SAM (Suspicious Activity Monitoring) tables are used to dynamically block traffic identified as suspicious or malicious; they are not consulted to permit normal UDP return traffic.
Check Point's Stateful Inspection engine creates a dynamic state table entry when an outbound UDP packet is permitted by policy. A subsequent inbound UDP packet is accepted as a valid reply only if its source IP and port match the original destination, and its destination IP and port match the original source - effectively simulating connection tracking for a stateless protocol.
SYN and SYN/ACK are TCP three-way handshake flags; UDP has no handshake mechanism whatsoever, so this option is technically impossible for UDP traffic.
ClusterXL forwarding layer behavior describes how a cluster member forwards packets to the pivot member and is a cluster traffic-handling mechanism, not a criterion for stateful acceptance of UDP packets.
Concept tested: Stateful inspection of UDP return traffic
Source: https://sc1.checkpoint.com/documents/R81/CP_R81_FirewallAdminGuide/html_frameset.htm
Topics
Community Discussion
No community discussion yet for this question.