Which is a stateful inspection firewall that can monitor TCP sessions and UDP traffic?

Which is a stateful inspection firewall that can monitor TCP sessions and UDP traffic?

• A. Packet filtering firewall
• B. Layer 4 firewall
• C. Layer 7 firewall
• D. State table

Answer: (B)

Stateful inspection relies on tracking ongoing connections in a state table so the firewall can decide based on the context of a session, not just individual packets. At the transport layer, a firewall that does this is a Layer 4 firewall. It monitors TCP sessions because TCP is connection-oriented and its state (handshake, data transfer, termination) is meaningful for security decisions. It can also handle UDP traffic by associating packets with a running per-flow context, letting legitimate replies pass while blocking unsolicited or out-of-order traffic. In contrast, a packet filtering firewall operates without tracking session state and makes decisions per packet, which can miss broader connection patterns. A Layer 7 firewall focuses on application-layer data and behavior rather than transport-layer session state. A state table is the data structure used by stateful firewalls, not a firewall type itself.

Stateful inspection relies on tracking ongoing connections in a state table so the firewall can decide based on the context of a session, not just individual packets. At the transport layer, a firewall that does this is a Layer 4 firewall. It monitors TCP sessions because TCP is connection-oriented and its state (handshake, data transfer, termination) is meaningful for security decisions. It can also handle UDP traffic by associating packets with a running per-flow context, letting legitimate replies pass while blocking unsolicited or out-of-order traffic.

In contrast, a packet filtering firewall operates without tracking session state and makes decisions per packet, which can miss broader connection patterns. A Layer 7 firewall focuses on application-layer data and behavior rather than transport-layer session state. A state table is the data structure used by stateful firewalls, not a firewall type itself.