Which of the following descriptions of stateful inspection firewalls is correct?

Question

Options

• AWhen the stateful detection firewall checks the packets, the previous and later packets of the same connection are not relevant.
• BStateful detection firewalls need to match rules for each data packet entering the firewall.
• CThe stateful detection firewall only needs to match the access rules for the first packet of the connection, and subsequent packets of the connection are directly matched in the state table.
• DBecause the UDP protocol is a connectionless protocol, the stateful detection firewall cannot match the state table of UDP packets.

• A
  8% (3)
• B
  73% (27)
• C
  3% (1)
• D
  16% (6)

Explanation

Important note: The answer key provided appears to contain an error - C is actually the correct answer, not B. Here's why:

Option B describes how stateless (packet-filtering) firewalls work, not stateful ones. Stateful inspection firewalls specifically exist to avoid checking every packet against the full ruleset. The firewall inspects the first packet of a new connection against the access control rules; if permitted, it creates an entry in the state table tracking that connection. All subsequent packets belonging to that established connection are matched against the state table directly - a much faster lookup - without re-running the full rule check.

Why the distractors are wrong:

• A is wrong because tracking prior packets is the defining feature of stateful inspection - connection context is everything.
• B is wrong (and is the actual description of a stateless/packet-filter firewall, not stateful).
• D is wrong because stateful firewalls can handle UDP by treating packets sharing the same 5-tuple (src IP, dst IP, src port, dst port, protocol) as a pseudo-connection, using a timeout to expire the state entry.

Memory tip: Think "state = remember the conversation." A stateful firewall remembers which connections it already approved, so it only interrogates strangers (first packets), not every word from a known, trusted conversation (subsequent packets).

If this is from an official exam source, I'd recommend flagging the answer key - C is the textbook-correct answer for stateful inspection firewall behavior.

No community discussion yet for this question.