Which description best distinguishes stateless and stateful firewall filtering?

• A. A firewall filters traffic between networks; stateless filters per packet; stateful tracks connection state for context.
• B. Stateless filters multiple packets together; stateful filters per IP address.
• C. Stateless stores connection state; stateful does not.
• D. Stateless is legacy, replaced by stateful only.

Answer: (A)

The core idea being tested is how a firewall decides what to allow when it sometimes needs memory of previous traffic. Stateless filtering makes decisions on each packet in isolation, using fixed rules like source/destination IP, port, and protocol. It doesn’t remember that a packet is part of an existing conversation, so it can’t determine whether a packet is legitimate based on context or connection history. Stateful filtering, on the other hand, keeps a record of active connections in a state table. It tracks the progression of a connection (for example, the TCP handshake and the ongoing exchange) and uses that context to decide whether new packets belong to an allowed, existing conversation. This lets the firewall recognize valid return traffic and enforce proper sequencing and timeouts, which helps protect against certain types of attacks and protocol abuses.

The description that says a firewall filters traffic between networks and that stateless filters per packet while stateful tracks connection state for context captures exactly how these approaches differ and why they work together. Stateless per-packet decisions are fast and simple but lack memory, while stateful filtering adds context by remembering connections.

The other descriptions mix up the concepts: stateless does not group multiple packets together, and stateful is not defined merely by IP address checks; stateless does not store connection state, and stateful is not purely about IP addresses. Also, stateless is not simply a legacy design replaced by stateful; both approaches exist and are used in different scenarios.