Of the three mechanisms Check Point uses for controlling traffic, which enables firewalls to incorporate layer 4 awareness in packet inspection?

IPS (Intrusion Prevention System) operates at Layer 7 to detect and block exploit patterns and malicious payloads; it does not provide the foundational Layer 4 connection-state awareness being described.

Packet filtering makes decisions based on static header fields such as source/destination IP and port numbers without maintaining any connection state, making it a stateless mechanism that lacks true Layer 4 awareness.

Stateful Inspection, developed by Check Point, goes beyond simple header inspection by recording the state of each connection in a state table, enabling the firewall to understand whether a packet belongs to an established, related, or new connection at the transport layer. This Layer 4 awareness allows the firewall to make permit or deny decisions based on connection context, not just individual packet headers. It distinguishes legitimate return traffic from unsolicited inbound packets using TCP/UDP session state.

Application Intelligence inspects traffic at Layer 7 to understand application-level protocols; it operates above Layer 4 and is not the mechanism responsible for transport-layer state tracking.