Which of the following descriptions of different types of firewalls are correct? (Multiple choice)

Question

Options

• AThe stateful inspection firewall security policy checks that the source and destination IP addresses comply with the policy to create stateful entries.
• BThe stateful inspection firewall only performs security policy inspection on the first packet that does not hit the session.
• CStateless firewalls can perform security policies that are independent of the session status.
• DBy default, the packet filtering firewall performs ACL matching checks on every data packet passing through the firewall.

• A
  27% (13)
• B
  73% (35)

Explanation

B, C, and D each accurately describe a core behavioral trait of their respective firewall types.

B is correct because stateful inspection firewalls use a session table as a fast path: only the first unmatched packet undergoes full security policy inspection; if it passes, a session entry is created and all subsequent packets belonging to that connection are forwarded by matching the session table directly, bypassing repeated policy evaluation.

C is correct because stateless (packet-filtering) firewalls have no concept of connection state - they evaluate each packet in isolation against static rules, so their policies inherently operate independently of whether a session is new, established, or closing.

D is correct because without a session table, a packet-filtering firewall must run every packet through ACL checks on every pass - there is no shortcut lookup to skip.

A is wrong because it misrepresents what creates a stateful entry. Stateful inspection examines the full security policy (protocol, ports, zones, etc.) on the first packet - not merely source/destination IP addresses - before creating a session entry. Reducing it to "IP address compliance" omits the complete policy check and mischaracterizes how stateful entries are generated.

Memory tip: Think "stateful = session shortcut, stateless = every packet, every time." Stateful firewalls do the hard work once (first packet) and then coast on the session table; stateless firewalls have no memory, so they re-check everything, every time, with ACLs.

No community discussion yet for this question.