A network administrator is implementing firewall policies on a stateful security appliance that protects internal servers on the subnet. The administrator needs to allow remote management via SSH from a trusted management workstation () to the internal servers while ensuring unapproved outbound connections from the servers to the Internet are blocked. Which of the following statements correctly describe how a stateful firewall processes traffic for this scenario? (Select TWO.)
- A single inbound rule permitting TCP port from to automatically allows outbound return packets for established sessions without needing a separate outbound rule.Answer
- BAn explicit outbound rule must be configured to permit SSH return traffic on TCP port back to host because firewalls evaluate outbound traffic independently of connection state.
- A new outbound TCP connection initiated directly by an internal server to an external public IP address will be blocked if no explicit outbound permit rule exists.Answer
- DInbound SSH administrative connections from require permitting UDP port because initial connection negotiation occurs over connectionless UDP.
Answer
Stateful firewalls automatically allow return traffic for established sessions using state table tracking, and they evaluate any newly initiated outbound connections against rule sets, blocking unmatched sessions via implicit deny.
Stateful firewalls maintain a state table to track established connections. When an inbound SSH connection from the management host is permitted, the firewall dynamically allows the corresponding return traffic from the server without requiring a separate reverse rule. Furthermore, any newly initiated session originated by an internal server requires a matching permit rule; otherwise, the firewall's default implicit deny policy blocks the outbound traffic.
Step-by-Step Solution
Key Concept
Stateful Inspection vs Stateless Filtering