UDP packets are delivered if they are _________.

Because UDP is connectionless, Check Point creates a dynamic state table entry when an outbound UDP packet matches an allow rule. A return packet is accepted only if it uses the exact inverse IP and port pair of the original request, providing stateful control over an inherently stateless protocol.

SYN and SYN-ACK are TCP connection-establishment flags; UDP has no handshake mechanism and these concepts do not apply to UDP traffic handling.

SAM (Suspicious Activity Monitoring) tables are used to dynamically block or rate-limit suspicious sources and are not the mechanism that governs legitimate UDP return traffic.

The ClusterXL forwarding layer distributes traffic among cluster members for load sharing or failover; it is not a delivery criterion that determines whether a UDP packet is permitted through the policy.