Which of the following would be used in a firewall to block incoming TCP packets that are not from established connections?

The correct answer is D. Stateful inspection. Stateful inspection (also called stateful packet filtering or dynamic packet filtering) is a firewall technique that maintains a state table of all active network connections. When a packet arrives, the firewall checks whether it belongs to an already-established, tracked…

Network security

Question

Options

AAccess control lists
BPort address translation
CBlocking unauthorized ports
DStateful inspection

How the community answered

(66 responses)

A
2% (1)
B
6% (4)
C
2% (1)
D
91% (60)

Explanation

Stateful inspection (also called stateful packet filtering or dynamic packet filtering) is a firewall technique that maintains a state table of all active network connections. When a packet arrives, the firewall checks whether it belongs to an already-established, tracked connection. Incoming TCP packets that were not initiated from inside the network are dropped because they have no matching entry in the state table. Access control lists (ACLs) perform static filtering based on IP addresses and ports, but they do not track connection state. Port Address Translation (PAT) is a form of NAT used to map multiple private IPs to a single public IP. Blocking unauthorized ports statically closes specific ports but does not distinguish between established and new connections.

Topics

#stateful inspection#firewall#TCP session tracking#packet filtering

Community Discussion

No community discussion yet for this question.

Full N10-005 Practice