N10-009 Network Security Practice Question
A security engineer is configuring a firewall to protect an internal network. The requirement is that internal users can initiate connections to the internet, but external hosts should not be able to initiate connections to internal hosts unless the internal host first requested the connection. Which firewall technology should be used?
⚠ Common exam trap
The N10-009 exam often tests the misconception that stateless packet filtering can handle return traffic by simply allowing inbound packets with a high source port, but without state tracking, it cannot verify that the packet actually belongs to an existing session, making stateful inspection the correct answer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Stateful inspection
Stateful inspection (B) tracks the state of active connections by maintaining a state table that records source/destination IPs, ports, and sequence numbers. It allows return traffic for connections initiated from the internal network while blocking unsolicited inbound traffic, which directly matches the requirement that external hosts cannot initiate connections unless the internal host requested them first.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Stateless packet filtering
Why it's wrong here
Stateless packet filtering examines each packet in isolation against a predefined set of rules, typically based on IP addresses, ports, and protocols, without any memory of previous packets or connection state. To allow return traffic for an internal host's outbound request, a stateless firewall would require a broad inbound rule, such as permitting all traffic from external web servers to internal web clients on ephemeral ports, which creates significant security vulnerabilities by allowing unsolicited inbound connections. This approach is inefficient and insecure for protecting an internal network from external threats.
When this WOULD be correct
A question that asks for a simple, low-overhead firewall technology to filter traffic based solely on source/destination IP addresses and port numbers, without requiring state tracking or application-layer inspection, such as in a small network with minimal security requirements.
- ✓
Stateful inspection
Why this is correct
Stateful inspection firewalls maintain a state table that tracks active connections, including source/destination IP addresses, port numbers, and sequence numbers. This allows them to dynamically permit return traffic for established outbound connections without needing explicit inbound rules, significantly enhancing security by only allowing legitimate responses and blocking unsolicited inbound packets. This method is highly effective for protecting internal networks by ensuring only traffic related to internal requests is allowed back in.
- ✗
Application proxy
Why it's wrong here
An application proxy firewall operates at the application layer, acting as an intermediary between internal clients and external servers. It terminates the connection from the client, inspects the application-layer traffic, and then establishes a new connection to the destination server. While application proxies offer deep packet inspection and can enforce granular policies based on application content, they are typically deployed for specific services (e.g., HTTP, FTP) and are not the primary or most efficient technology for general stateful traffic control across an entire internal network, which is better handled by a stateful inspection firewall.
When this WOULD be correct
A question requiring deep packet inspection, content filtering, or authentication at the application layer, such as 'Which firewall technology can block specific HTTP methods or inspect SQL queries?' would make application proxy the correct answer.
- ✗
Packet filtering based on ACL only
Why it's wrong here
Access Control Lists (ACLs) define rules to permit or deny traffic based on criteria like source/destination IP, port, and protocol, operating at the network and transport layers. When used as the sole filtering mechanism, ACLs are inherently stateless; they do not track connection states. Consequently, to allow return traffic for an internal host's outbound connection, an ACL would necessitate creating explicit, often broad, inbound rules for expected responses, which is difficult to manage, prone to misconfiguration, and significantly less secure than stateful inspection.
When this WOULD be correct
A question that asks for a simple, low-overhead method to allow or deny traffic based on source/destination IP addresses and ports, without requiring state tracking, such as in a small network with static rules and no need for connection awareness.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓Stateful inspectionCorrect answer▾
Why this is correct
Stateful inspection firewalls maintain a state table that tracks active connections, including source/destination IP addresses, port numbers, and sequence numbers. This allows them to dynamically permit return traffic for established outbound connections without needing explicit inbound rules, significantly enhancing security by only allowing legitimate responses and blocking unsolicited inbound packets. This method is highly effective for protecting internal networks by ensuring only traffic related to internal requests is allowed back in.
✗Stateless packet filteringWrong answer — click to see why▾
Why this is wrong here
Stateless packet filtering does not track connection state, so it cannot distinguish between packets belonging to a new connection initiated by an external host versus a response to an internal request. It cannot enforce the requirement that external hosts cannot initiate connections unless the internal host first requested it.
★ When this WOULD be the correct answer
A question that asks for a simple, low-overhead firewall technology to filter traffic based solely on source/destination IP addresses and port numbers, without requiring state tracking or application-layer inspection, such as in a small network with minimal security requirements.
Why candidates choose this
Candidates may confuse stateless filtering with stateful inspection, thinking that ACLs can be configured to allow return traffic, but they overlook that stateless firewalls cannot dynamically permit return traffic without explicit rules for every possible response.
✗Application proxyWrong answer — click to see why▾
Why this is wrong here
An application proxy operates at Layer 7 and can inspect application data, but it does not inherently track connection state to allow return traffic for outbound requests; stateful inspection is specifically designed for that purpose.
★ When this WOULD be the correct answer
A question requiring deep packet inspection, content filtering, or authentication at the application layer, such as 'Which firewall technology can block specific HTTP methods or inspect SQL queries?' would make application proxy the correct answer.
Why candidates choose this
Candidates may confuse proxy firewalls with stateful firewalls because both can handle outbound traffic, but they overlook that stateful inspection is the standard for tracking connection states to permit return traffic.
✗Packet filtering based on ACL onlyWrong answer — click to see why▾
Why this is wrong here
Packet filtering based on ACL only cannot track connection state, so it cannot distinguish between packets belonging to a new connection initiated by an external host and those belonging to an existing connection initiated by an internal host.
★ When this WOULD be the correct answer
A question that asks for a simple, low-overhead method to allow or deny traffic based on source/destination IP addresses and ports, without requiring state tracking, such as in a small network with static rules and no need for connection awareness.
Why candidates choose this
Candidates may think ACL-based filtering is sufficient for basic security and overlook the requirement for stateful tracking of connection initiation direction.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This N10-009 question is part of Courseiva's 464-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.