A firewall at a retailer permits return traffic only when that traffic belongs to a connection an inside host already opened. Which inspection mode is the firewall using?
Select an answer to reveal the explanation.
Short Explanation
A coat check hands a coat back only when that coat was checked in, and it does not read the fine print in the lining. You are seeing return traffic allowed only for a connection an inside host already opened. The trap is a stateless header check, payload inspection, or a copy port that does not make the decision.
Full Explanation
Stateful inspection that keeps a connection table and allows return packets only for a connection an inside host opened is the mode. The firewall keeps a connection table of sessions an inside host opened, and it permits return packets only when they belong to one of those sessions. That memory of the connection, not a fresh look at each packet in isolation, is stateful inspection. A packet filter with no connection table that judges every packet from its own headers has no connection table and judges each packet on its own headers. It cannot express "return traffic only for a connection the inside host opened," because it does not remember the opening. Deep inspection of the application payload inside each packet the firewall is forwarding reads application payload. The retailer's rule is about which connection the return packets belong to, and it does not require reading the payload to make that decision. A SPAN port that copies packets to a monitor and leaves the permit decision to another device copies packets toward a monitor. A copy port does not permit or deny return traffic, so it is not the mode making this allow decision. Exam caveat: tracking the connection is not the same as reading application content. A stateful rule can allow the return packets and still be blind to the payload. Operational check: find the connection-table entry for the inside-initiated flow and confirm the return packets match that entry before you treat them as allowed.