A packet that is already associated with a current session arrives at the firewall. What is the flow of the packet after the firewall determines that it is matched with an existing session?

Question

Options

• Ait is sent through the fast path because session establishment is not required. If subject to content
• BIt is sent through the slow path for further inspection. If subject to content inspection, it will pass
• CIt is sent through the fast path because session establishment is not required. If subject to content
• DIt is sent through the slow path for further inspection. If subject to content inspection, it will pass

• A
  80% (49)
• B
  11% (7)
• C
  5% (3)
• D
  3% (2)

Explanation

Option A is correct because when a packet matches an existing session, the firewall already completed the full policy evaluation during session establishment - so the packet is forwarded via the fast path, bypassing the overhead of a full security policy lookup. However, if the session is subject to content inspection (e.g., threat prevention, App-ID, URL filtering), that inspection still occurs even on the fast path.

Why the distractors are wrong:

• B and D are wrong because they claim the packet goes through the slow path - the slow path is reserved for new sessions that require full policy matching, NAT evaluation, and session creation; it would be wasteful and incorrect to re-process already-established sessions this way.
• C is a near-miss distractor that likely differs in how it describes content inspection behavior - it may incorrectly state content inspection is skipped entirely or handled differently than A describes.

Memory tip: Think of it like airport security - on your first flight (new session = slow path), you go through full screening. On a connecting flight (existing session = fast path), you're already cleared, so you move quickly, but you can still be subject to spot checks (content inspection). Fast path = established trust, but not immunity.

No community discussion yet for this question.