A network engineer is configuring traffic filtering between a web application cluster in a DMZ () and a backend database subnet (). Web application servers must initiate queries to a database server listening on TCP port . The security architecture incorporates both a stateful inspection firewall and stateless router Access Control Lists (ACLs). Which TWO of the following statements correctly describe the filtering requirements and expected packet behavior for this deployment?
- The stateful firewall automatically permits return database response traffic to the DMZ web servers once the outbound connection on TCP port is established, without needing an explicit inbound return rule.Answer
- The stateless router ACL requires an explicit rule permitting return traffic from TCP port back to the DMZ ephemeral port range to allow full bidirectional communication.Answer
- CPostgreSQL database communication operates exclusively over connectionless UDP port , requiring ACL rules to specify UDP rather than TCP for state tracking to function.
- DAn extended ACL created with only a single permit rule for port will forward all unspecified network traffic because explicit deny statements are required to drop packets.
Answer
The stateful firewall automatically permits return response traffic for established TCP connections without separate return rules, whereas the stateless router ACL requires an explicit permit entry for return traffic targeting ephemeral ports.
Stateful firewalls track TCP connection state, automatically allowing legitimate return packets without needing reverse rules. In contrast, stateless ACLs evaluate each packet in isolation, requiring explicit return rules for response traffic originating from the server back to client ephemeral ports.
Step-by-Step Solution
Key Concept
Difference between stateful firewall session tracking and stateless ACL per-packet filtering