CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  It examines each packet individually without considering the state of a connection.

  Why this is correct

  A stateless firewall treats each packet in complete isolation, with no memory of prior packets or any session context. Since it does not maintain a connection table, it cannot determine whether a packet belongs to an ongoing exchange, so every packet is evaluated with the same independent logic. This is the defining contrast to stateful firewalls, which track connection state to make more informed decisions.

• ✓

  It can filter traffic based on source and destination IP addresses.

  Why this is correct

  Stateless firewalls use filtering rules that can match on Layer 3 addressing, specifically the source and destination IP address fields found in the IP packet header. This capability allows an administrator to permit or deny traffic based on the host or network it came from or is going to, such as blocking all traffic from an untrusted subnet. IP-based matching is a fundamental and efficient criterion for basic packet filtering.

• ✗

  It can inspect the application-layer payload to detect malicious content.

  Why it's wrong here

  Inspecting application-layer payloads to detect malicious content requires deep packet inspection, which involves reassembling application data and analyzing it for signatures or anomalies. A stateless firewall does not maintain connection context and typically only examines packet headers, so it cannot parse or understand the application-layer payload. This type of threat detection is performed by next-generation firewalls or intrusion prevention systems, not by stateless packet filters.

• ✓

  It can filter traffic based on source and destination port numbers.

  Why this is correct

  In addition to IP addressing, a stateless firewall can filter traffic by referencing the source and destination port numbers carried in the TCP or UDP header. This enables service-based filtering, for example, allowing web traffic on port 80 or 443 while blocking Telnet on port 23. Port matching is a standard ACL criterion that works alongside IP matching to define acceptable traffic at the transport layer.

• ✗

  It automatically allows return traffic for established connections.

  Why it's wrong here

  Automatically allowing return traffic for established connections is a stateful firewall feature because it requires tracking the state of each session and knowing which packets belong to an existing flow. A stateless firewall has no connection state table, so it cannot recognize a packet as a reply to a previously permitted request. To support bidirectional communication, an administrator must explicitly configure separate rules for each direction, including the return traffic.

• ✓

  It uses an ordered list of permit or deny rules, processing packets in sequence until a match is found.

  Why this is correct

  Stateless firewalls rely on an ordered list of permit or deny rules, typically implemented as access control lists, and each packet is processed against those rules in sequence. Once a rule matches, the corresponding action is applied and evaluation stops; no subsequent rules are considered. This sequential, order-sensitive behavior means the placement of rules is critical, as a broad rule placed earlier can override later, more specific rules.

Go deeper

Related to this question