What is a fundamental characteristic of stateful inspection firewall behavior?

What is a fundamental characteristic of stateful inspection firewall behavior?

• A. Verifies packets belong to an established session
• B. Performs deep content inspection
• C. Only filters by IP address
• D. Provides password authentication

Answer: (A)

Stateful inspection firewalls track the state of active connections. They don’t just inspect packets in isolation; they maintain a state table that records what connections exist and where they are in the communication (for example, whether a TCP handshake has completed). Because of this, only packets that belong to an established or valid session are allowed through. This helps ensure responses to requests are legitimate and guards against certain spoofed or out-of-state traffic. Deep content inspection is more about examining the payload in detail, which is characteristic of other security mechanisms rather than the defining behavior of stateful inspection. Filtering only by IP address describes a stateless approach, and password authentication is not a core firewall function.

Stateful inspection firewalls track the state of active connections. They don’t just inspect packets in isolation; they maintain a state table that records what connections exist and where they are in the communication (for example, whether a TCP handshake has completed). Because of this, only packets that belong to an established or valid session are allowed through. This helps ensure responses to requests are legitimate and guards against certain spoofed or out-of-state traffic.

Deep content inspection is more about examining the payload in detail, which is characteristic of other security mechanisms rather than the defining behavior of stateful inspection. Filtering only by IP address describes a stateless approach, and password authentication is not a core firewall function.