During a blackbox pen test you attempt to pass IRC traffic over port 80/TCP from a compromised web enabled host. The traffic gets blocked; however, outbound HTTP traffic is unimpeded. What type of fir

An application-layer proxy firewall also performs deep content inspection at layer 7, but CEH exam taxonomy places protocol-anomaly detection via session tracking under stateful inspection for this scenario.

A circuit-level gateway operates at the session layer and validates TCP handshake completion but does not inspect the actual application-layer content or protocol of the transmitted data.

A stateful inspection firewall tracks the full state of active network connections and inspects packet payloads to verify that traffic conforms to the expected protocol behavior for a given port. Because IRC traffic does not match HTTP protocol signatures, the stateful firewall detects the mismatch and blocks it even though port 80 is permitted. This capability goes beyond simple port-based filtering by analyzing session state and protocol compliance.

A packet filtering firewall only examines layer 3 and 4 header fields such as IP addresses and port numbers, so it would permit any traffic on port 80 without verifying protocol compliance.