Which statement describes stateful firewall inspection?

• A. Maintains context of all packets individually.
• B. Only inspects packets at layer 1.
• C. Does not inspect packets.
• D. Tracks active connections and context across a session.

Answer: (D)

Stateful firewall inspection works by tracking the state of active connections and the context of a session. It keeps a dynamic record of ongoing conversations—source and destination IPs and ports, and where each packet is in the protocol handshake or data exchange—so it can determine if a packet belongs to an established, permitted connection and whether its behavior is valid within that session. This ability to retain session state across multiple packets is what differentiates it from stateless filtering, which evaluates each packet in isolation.

Maintaining context for each packet individually describes stateless filtering, which doesn’t remember prior packets in the same session. Inspecting only layer 1 is insufficient because stateful inspection relies on transport and higher-layer information. Not inspecting packets at all isn’t a firewall behavior. So the description that matches stateful inspection is the one that highlights tracking active connections and session context.