Which of the following statements regarding the stateful inspection firewall is true?

Question

Options

• AWhen the stateful inspection firewall checks packets, packets of only same connection are not correlated.
• BBecause UDP is a connectionless protocol, the stateful inspection firewall cannot match UDP packets with the status table.
• CThe stateful inspection firewall only needs to match the first data packet against a rule, and the subsequent packets of the connection are matched directly in the state table.
• DThe stateful inspection firewall needs to match the rules for each incoming packet.

• A
  7% (4)
• B
  4% (2)
• C
  75% (42)
• D
  14% (8)

Explanation

Option C is correct because stateful inspection firewalls maintain a connection state table: the first packet of a new connection is evaluated against the full rule set, and if permitted, an entry is created in the state table. All subsequent packets belonging to that same session are then checked only against the state table - not re-evaluated against every rule - making the process significantly faster than stateless packet filtering.

Why the distractors are wrong:

• A is the opposite of how stateful inspection works - correlating packets of the same connection is its defining feature.
• B is false because stateful firewalls can handle UDP by creating pseudo-state entries (tracked by source/destination IP and port), even though UDP has no formal connection handshake.
• D describes a stateless (packet-filtering) firewall, which checks every packet against the full rule set independently - the exact inefficiency stateful inspection was designed to overcome.

Memory tip: Think of stateful inspection like a bouncer at a club - the first person in a group gets their ID checked against the full list (rule matching), but once they're in and their table is noted (state entry), the rest of the group just shows their wristband (state table match) to get in.

No community discussion yet for this question.