On a stateful inspection firewall, when the status detection mechanism is enabled and the second packet (SYN+ACK) of 3-way handshake sequence reaches the firewall. Which of the following statements…

Question

Options

• AIf the firewall security policy permits packets to pass, the session table is created.
• BThe firewall only checks packets, and if the security policy is configured packets can pass.
• CPackets must pass the firewall, and a session table is established.
• DIf the firewall security policy permits packets to pass, the packets can pass the firewall.

• A
  2% (1)
• B
  10% (5)
• C
  4% (2)
• D
  83% (40)

Explanation

Option D is correct because on a stateful inspection firewall, the session table is created when the first packet (SYN) passes the security policy check - by the time the SYN+ACK arrives, the session entry already exists, and the firewall simply allows the SYN+ACK to pass by matching it against that existing entry, contingent on the policy having already approved the session.

A is wrong because the session table was already created when the original SYN packet was processed - the SYN+ACK does not trigger session table creation. C is wrong for the same reason: the session table is already established, not being established now, and packets do not unconditionally "must pass." B is wrong because stateful inspection's core value is that subsequent packets in a session are matched against the session table - not re-evaluated against the security policy each time - so saying the firewall "only checks packets" against the policy misrepresents how stateful inspection works.

Memory tip: Think of it as a three-act play - the SYN is the audition (security policy decides yes/no), SYN+ACK is the rehearsal (already approved, just show your session-table ID at the door), and ACK is opening night (session fully established). The session table is born with the SYN, never with the SYN+ACK.

No community discussion yet for this question.