Stateful Inspection is also called dynamic packet filtering; it tracks the state of network connections and only permits packets that match an established connection. What best describes this concept?

• A. It is a virus scanning technique.
• B. It is a router protocol.
• C. It is a wireless security standard.
• D. It is a firewall capability that tracks the state of network connections and permits only packets matching established connections.

Answer: (D)

Stateful inspection is the firewall capability that tracks active connections and only allows packets that belong to an established session. It keeps a state table of ongoing communications, such as TCP connections, and when a packet arrives, it checks whether it fits an existing, recognized connection. If it does, the packet is permitted; if not, it’s blocked. This context-aware filtering goes beyond examining each packet in isolation, helping prevent spoofed or unsolicited traffic because there’s a valid, ongoing exchange behind each allowed packet. The other options don’t fit because this concept isn’t a virus scanning technique, a router protocol, or a wireless security standard.