ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Stateful inspection firewalls maintain a connection table that records the state of every allowed outbound session. When the server initiates an RPC session, the firewall notes the five-tuple of the connection and automatically permits the corresponding return traffic on whatever ephemeral port is negotiated, eliminating the need to pre-open large port ranges. Stateless packet filters lack this capability because they evaluate each packet in isolation based only on static rules, so they would require manual rules for every possible return port. Deep packet inspection focuses on payload content rather than connection state, and network address translation manipulates IP addresses but does not inherently track session state for security filtering.