Which term describes a firewall that primarily inspects traffic at the transport layer, tracking TCP/UDP connections?

Which term describes a firewall that primarily inspects traffic at the transport layer, tracking TCP/UDP connections?

• A. Layer 4 firewall
• B. Layer 7 firewall
• C. Packet filtering firewall
• D. Stateful inspection

Answer: (A)

Tracking the state of active connections at the transport layer defines how a firewall decides which packets to let through. This capability—keeping a table of TCP/UDP sessions and using that context to allow, deny, or modify traffic—is what differentiates this type of firewall from simpler packet filters. By monitoring the lifecycle of a connection (handshake, established state, and termination), it can validate that incoming packets belong to a legitimate, existing connection or belong to an expected state transition, and block packets that don’t fit the current state. This is why the term that best fits is stateful inspection: it explicitly captures both transport-layer inspection and connection-state tracking. A Layer 4 description alone emphasizes the layer where decisions are made but not the state-tracking behavior, so it’s less precise when the description mentions tracking connections. A Layer 7 firewall operates at the application layer and inspects application-level data, which isn’t what’s described here. A packet-filtering firewall is typically stateless and doesn’t maintain connection state, so it wouldn’t fulfill the “tracking TCP/UDP connections” aspect.

Tracking the state of active connections at the transport layer defines how a firewall decides which packets to let through. This capability—keeping a table of TCP/UDP sessions and using that context to allow, deny, or modify traffic—is what differentiates this type of firewall from simpler packet filters. By monitoring the lifecycle of a connection (handshake, established state, and termination), it can validate that incoming packets belong to a legitimate, existing connection or belong to an expected state transition, and block packets that don’t fit the current state. This is why the term that best fits is stateful inspection: it explicitly captures both transport-layer inspection and connection-state tracking.

A Layer 4 description alone emphasizes the layer where decisions are made but not the state-tracking behavior, so it’s less precise when the description mentions tracking connections. A Layer 7 firewall operates at the application layer and inspects application-level data, which isn’t what’s described here. A packet-filtering firewall is typically stateless and doesn’t maintain connection state, so it wouldn’t fulfill the “tracking TCP/UDP connections” aspect.