During a penetration test, the tester conducts an ACK scan using NMAP against the external interface of the DMZ firewall. NMAP reports that port 80 is unfiltered. Based on this response, which type of

Host-based inspection refers to security controls running on the endpoint itself, not a firewall packet inspection methodology.

A stateful firewall maintains a connection state table and would drop an unsolicited ACK packet - no matching SYN/SYN-ACK - causing NMAP to report the port as 'filtered,' not 'unfiltered.'

A stateless (packet filter) firewall evaluates each packet independently against static rules without maintaining a connection state table. When NMAP sends an ACK packet with no prior SYN, a stateless firewall has no record of an established connection to check against and may permit the packet based solely on port rules, causing NMAP to report the port as 'unfiltered.' A stateful firewall would recognize the ACK as belonging to no known session and drop it, reporting the port as 'filtered.'

Application-level inspection performs deep packet inspection of payload content at layer 7 and would similarly be able to identify and block illegitimate ACK packets.