Which statement best differentiates stateless firewalls from stateful firewalls?

Which statement best differentiates stateless firewalls from stateful firewalls?

• A. Stateful firewalls track session state and context.
• B. Stateless firewalls filter per packet without tracking connections.
• C. Stateless firewalls maintain full session state for each connection.
• D. Stateful firewalls ignore connection context to speed up processing.

Answer: (A)

Tracking session state across a connection is what separates stateful from stateless firewalls. A stateful firewall builds and uses a dynamic table that records each active connection’s context—source and destination addresses and ports, protocol, and where the packet is in the handshake or data transfer. That means once a connection is established, subsequent packets are recognized as part of that conversation and can be allowed or blocked based on the ongoing state, rather than rechecking every rule from scratch. This capability is exactly what the statement describes: stateful firewalls track session state and context. Stateless firewalls, in contrast, evaluate each packet on its own without remembering previous packets, so they don’t rely on the broader connection context to make decisions. The other options either misattribute stateful behavior to stateless, or imply that stateful devices ignore context, which is not how they operate.

Tracking session state across a connection is what separates stateful from stateless firewalls. A stateful firewall builds and uses a dynamic table that records each active connection’s context—source and destination addresses and ports, protocol, and where the packet is in the handshake or data transfer. That means once a connection is established, subsequent packets are recognized as part of that conversation and can be allowed or blocked based on the ongoing state, rather than rechecking every rule from scratch. This capability is exactly what the statement describes: stateful firewalls track session state and context.

Stateless firewalls, in contrast, evaluate each packet on its own without remembering previous packets, so they don’t rely on the broader connection context to make decisions. The other options either misattribute stateful behavior to stateless, or imply that stateful devices ignore context, which is not how they operate.