During a penetration test, the tester conducts an ACK scan using NMAP against the external interface of the DMZ firewall. NMAP reports that port 80 is unfiltered. Based on this response, which type…

Host-based inspection refers to security controls running on an endpoint rather than a network firewall, and would not be the type of inspection performed by a DMZ firewall at the network perimeter.

A stateful firewall tracks TCP handshake sequences and would drop an unsolicited ACK packet since no corresponding connection entry exists in its state table, causing NMAP to report the port as filtered rather than unfiltered.

A stateless (packet filter) firewall evaluates each packet independently against static rules without maintaining a connection state table. When an unsolicited ACK packet arrives, a stateless firewall simply checks whether port 80 is permitted and passes it through, returning 'unfiltered.' A stateful firewall would drop this packet because there is no matching SYN entry in its state table to legitimize the ACK, which would cause NMAP to report the port as 'filtered.'

Application-layer inspection performs deep packet analysis of payload content and would also likely drop unsolicited ACK packets, and this level of inspection is not indicated by an unfiltered ACK scan result.