Which of the following is MOST effective in detecting information hiding in Transmission Control Protocol/internet Protocol (TCP/IP) traffic?

A stateful inspection firewall tracks TCP/IP connection state and header information but does not inspect application-layer payload content, making it blind to data hidden within legitimate protocol streams.

An application-level firewall (application proxy/gateway) operates at Layer 7 of the OSI model and can fully reconstruct and inspect the content of application-layer protocols such as HTTP, FTP, and DNS. This deep visibility allows it to detect anomalies in protocol usage, unexpected payloads, and covert channels where data is hidden within legitimate-looking traffic - capabilities not available to firewalls that only inspect headers or state.

A content-filtering proxy can block known malicious or prohibited content categories but is not specifically designed to detect covert channels or steganographic techniques embedded within TCP/IP protocol fields or application data.

A packet-filter firewall makes allow/deny decisions based solely on IP addresses, ports, and basic header fields (Layer 3/4), providing no ability to examine payload content where information hiding techniques operate.