Examkin

Question

Difficulty: MediumFirewalls and Access Control Lists (ACLs)

A network security engineer configures a stateful firewall to protect an internal database server residing at 10.0.1.5010.0.1.50 that receives connections from an application server at 10.0.2.1010.0.2.10 over TCP port 14331433. An inbound rule permitting traffic from source IP 10.0.2.1010.0.2.10 to destination IP 10.0.1.5010.0.1.50 on TCP port 14331433 is explicitly applied. Although no explicit outbound rule is created to permit return traffic from the database server back to the application server's ephemeral ports, communication functions normally without packet drops. Which of the following best explains why the return traffic is successfully permitted through the firewall?

  1. Stateful firewalls maintain a state table tracking active TCP connections and dynamically permit return traffic matching established sessions.Answer
  2. B
    Firewall policy sets include an implicit permit statement at the end of the rule list that automatically allows unlisted outbound traffic.
  3. C
    Return traffic operates exclusively at Layer 2, bypassing transport layer firewall inspection once initial frames are logged.
  4. D
    The firewall automatically converts the TCP session into a connectionless UDP flow for return traffic to bypass destination port filters.

Answer

Stateful firewalls maintain a state table tracking active TCP connections and dynamically permit return traffic matching established sessions.
Stateful firewalls maintain an internal connection state table. When an initial connection request matches an inbound rule, the firewall records the source IP, destination IP, source port, and destination port. Any subsequent return traffic belonging to that active session is automatically permitted without requiring a separate explicit outbound rule.

Step-by-Step Solution

1
Analyze the operational difference between stateful firewalls and stateless Access Control Lists (ACLs).
Stateless filters inspect each packet in isolation and require explicit rules for both request and response traffic directions, whereas stateful firewalls track connection context.
Understanding state tracking is essential to determine how return packets are evaluated.
2
Evaluate how stateful firewalls process return packets for established TCP streams.
When the initial inbound packet matching the permitted rule (TCP 14331433) passes through, the firewall adds an entry to its state table. Return packets matching this active session are automatically validated and permitted.
Dynamic session tracking eliminates the need for separate outbound rules for response traffic on ephemeral ports.

Key Concept

Stateful Packet Inspection vs. Stateless Filtering
Estimated Time:1m 15s
Rate this question

Topics

Firewalls and Access Control Lists (ACLs)

More questions from this topic