Stateful inspection firewalls use session tables to track active TCP sessions and UDP sessions, and the firewall security policy determines which sessions are permitted, and packets will only be…

Question

Options

• ATRUE
• BFALSE

• A
  83% (53)
• B
  17% (11)

Explanation

Option A is correct because stateful inspection firewalls (also called dynamic packet filtering firewalls) maintain a state table (session table) that tracks the state of active network connections - both TCP sessions and UDP pseudo-sessions. When a packet arrives, the firewall checks it against this table: if it belongs to an established, permitted session, it passes; if it doesn't match any known session and isn't allowed to start a new one by policy, it's dropped. This is what distinguishes stateful firewalls from simple packet filters, which evaluate each packet in isolation without any connection context. Option B is wrong because there is no meaningful distractor here - the statement is a textbook-accurate description of how stateful inspection works.

Memory tip: Think of the session table as a "guest list" at a venue - the security policy decides who gets in, and once you're in (session established), the bouncer (firewall) waves your packets through without re-checking every time.

No community discussion yet for this question.