Which statement best describes stateful firewall operation?

Which statement best describes stateful firewall operation?

• A. Stateful tracks connection state and contextual info.
• B. Stateless filters packets individually without context.
• C. Stateful operates at the application layer exclusively.
• D. Stateless maintains history of connections.

Answer: (A)

Stateful firewall operation hinges on tracking the state of active connections and contextual information about traffic. It builds and consults a state table that records each connection’s status (such as new, established, or related) and uses that context to decide whether to allow or drop packets. Because decisions are based on the connection’s state, return traffic for an allowed session can pass without needing a separate rule for every packet. For example, when a host opens a TCP connection to a server, the initial outbound packet is checked and, once the connection is established, subsequent packets are treated as part of that existing session. This approach improves security and efficiency by not evaluating each packet in isolation and by filtering traffic based on connection state. In contrast, a stateless filter examines each packet independently without context, requiring explicit rules for related traffic and often failing to recognize legitimate return traffic.

Stateful firewall operation hinges on tracking the state of active connections and contextual information about traffic. It builds and consults a state table that records each connection’s status (such as new, established, or related) and uses that context to decide whether to allow or drop packets. Because decisions are based on the connection’s state, return traffic for an allowed session can pass without needing a separate rule for every packet. For example, when a host opens a TCP connection to a server, the initial outbound packet is checked and, once the connection is established, subsequent packets are treated as part of that existing session. This approach improves security and efficiency by not evaluating each packet in isolation and by filtering traffic based on connection state. In contrast, a stateless filter examines each packet independently without context, requiring explicit rules for related traffic and often failing to recognize legitimate return traffic.