Question

A firewall that can check for legitimate connections and source and destination IPs to determine which data packets can pass through is called ________.

• A. Packet filtering firewall
• B. Hardware firewall
• C. Stateful inspection firewall
• D. Internet connection firewall

Hint:

A Stateful Inspection firewall is highly secure because it remembers the context of network conversations. It automatically permits returning traffic from a connection you initiated while blocking outside intrusion attempts.

Answer 1

The Correct Option is C

Step 1: Analyzing Firewall Packet Inspection Techniques:
Firewalls regulate network traffic by inspecting data packets and comparing them against pre-defined security rules.

Step 2: Comparing Packet Filtering and Stateful Inspection:
Let's analyze the core technical differences between these two firewall types:

• Packet Filtering Firewall (A): Inspects each packet individually in isolation. It only checks the packet header for source/destination IP addresses and ports. It has no memory of previous packets and cannot determine if a packet is part of an established, legitimate connection.
• Stateful Inspection Firewall (C): Tracks the state of active network connections (handshakes, active sessions, and connection teardowns) in a dynamic state table. When a packet arrives, the firewall verifies if it matches an established, legitimate connection already listed in the state table. This allows incoming packets from established sessions to pass through safely while blocking unsolicited packets, significantly enhancing security.

Step 3: Conclusion:
A firewall that tracks active sessions and validates if incoming packets belong to established, legitimate connections is a Stateful inspection firewall, corresponding to option (C).