(ISC)2 Certified in Cybersecurity Practice Exam

_____________ firewalls track open connections.

1. Stateful

2. Stateless

3. Semi-Stateful

4. Semi-Stateless

The correct answer is: Stateful

Stateful firewalls are designed to monitor and track the state of active connections across a network. They maintain a state table that stores information about each active connection, such as source IP address, destination IP address, port numbers, and the state of the connection (e.g., established, closing). This capability allows stateful firewalls to make more informed decisions about the traffic passing through them, as they consider the current state of the connection rather than just filtering packets based on predefined rules. By keeping track of these open connections, stateful firewalls can determine if an incoming packet is part of an established connection or if it is a new connection attempt. This allows them to allow or block traffic intelligently. For example, if a packet arrives that is part of an existing connection, it can be allowed through, while packets that do not match any existing sessions can be denied, enhancing both security and performance. In contrast, stateless firewalls do not maintain any state or connection information, merely inspecting each packet in isolation against a set of rules. This can be less effective in recognizing and allowing legitimate traffic that is part of an ongoing session. The other choices, semi-stateful and semi-stateless, are not standard terms widely recognized in the context of firewall