You are the Administrator for a corporate network. You are concerned about denial of service attacks. Which of the following would be the most help against Denial of Service (DOS) attacks?

A packet filtering firewall only inspects individual packet headers without tracking connection state, making it unable to detect flood-based or stateful DoS attack patterns.

Network surveys are assessment activities used to discover devices and topology on a network, and provide no active protection or mitigation against DoS attack traffic.

A honeypot is a decoy system designed to lure and study attackers, but it does not actively block or mitigate DoS attack traffic directed at production systems.

Stateful Packet Inspection firewalls maintain a state table of all active connections, allowing them to identify and block traffic that does not match a legitimate established session - a key characteristic of many DoS attacks such as SYN floods. Unlike basic packet filtering, SPI can recognize when connection attempts are anomalous, half-open, or do not follow the normal TCP handshake sequence. This state-awareness makes SPI firewalls significantly more effective at mitigating DoS attacks than stateless alternatives.