Which of the following types of firewall ensures that the packets are part of the established session?

An application-level firewall (proxy firewall) inspects traffic at the application layer for content filtering, not specifically for session membership verification.

A circuit-level firewall validates TCP handshakes at the session layer but does not continuously verify that subsequent packets belong to the established session.

A stateful inspection firewall maintains a state table of all active network connections and checks each incoming packet against this table to confirm it is part of a legitimate, previously established session. Packets that do not match an existing session entry are dropped, preventing unsolicited inbound traffic. This mechanism operates at the network layer while understanding session context, distinguishing it from simple packet filters.

Switch-level firewall is not a standard firewall classification and does not describe a mechanism for session-based packet validation.