In a stateful firewall application, inspection occurs at which layer of the OSI model?

Question

Options

• A7
• B3
• C4
• D2

• A
  95% (54)
• B
  2% (1)
• C
  4% (2)

Explanation

Option A is correct because a stateful firewall with application inspection performs deep packet inspection (DPI) at Layer 7 (Application), meaning it examines the actual payload and application-level context - not just headers - to make access control decisions based on the full state of a connection.

Why the others are wrong:

• Layer 2 (D) is the Data Link layer, where simple switches operate using MAC addresses - no firewall inspection happens here.
• Layer 3 (B) is where basic packet-filtering firewalls operate, checking only IP addresses and routing information without tracking connection state.
• Layer 4 (C) is where traditional stateful firewalls track TCP/UDP connection state (open/established/closed) - but this is less sophisticated than full application inspection.

Memory tip: Think of the OSI layers as a building: the higher the floor, the more context you have. A Layer 7 firewall sits at the top floor and can see the entire conversation, not just the envelope (Layer 3) or the delivery route (Layer 4). "Stateful application inspection = top layer inspection."

Note for exam takers: Some resources classify traditional stateful firewalls at Layer 4. If your exam distinguishes between "stateful inspection" (Layer 4) and "stateful application inspection" or NGFW (Layer 7), choose based on whether the question emphasizes application-layer awareness.

No community discussion yet for this question.