ISC2 CC Network Security Practice Question
A network administrator wants to control traffic based on source and destination IP addresses and port numbers, while also tracking the state of connections. Which type of firewall should they choose?
⚠ Common exam trap
The trap is conflating 'stateful inspection' with 'NGFW' — candidates see 'control traffic by IP and port' and jump to NGFW, but the question's second clause ('tracking the state of connections') is the textbook definition of stateful inspection, and NGFW is a superset that isn't required here.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Stateful inspection
Stateful inspection firewalls maintain a state table that tracks the context of each connection (source/destination IP, ports, and TCP flags), allowing return traffic for established sessions without an explicit rule. This satisfies both requirements in the question: filtering by IP and port, and tracking connection state. Stateless filters can match IPs and ports but have no memory of sessions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Stateless packet filtering
Why it's wrong here
Stateless packet filtering evaluates each packet in isolation against ACLs, so it cannot track connection state such as established TCP sessions. It is tempting because it filters on IP addresses and ports cheaply, but the requirement to track connection state demands a stateful firewall.
- ✗
Application proxy
Why it's wrong here
An application proxy inspects traffic at layer 7 and terminates client connections, so it does not filter on source and destination IP addresses and port numbers as required. It is tempting because proxies track session state, but that statefulness applies to proxied application sessions, not layer 3/4 connection tracking.
- ✓
Stateful inspection
Why this is correct
Stateful inspection tracks connection state in a session table, so it filters on source and destination IP addresses and ports while recognising established flows. Stateless packet filtering cannot track connection state, which the stem explicitly requires.
- ✗
Next-generation firewall (NGFW)
Why it's wrong here
An NGFW adds application awareness, intrusion prevention and deep packet inspection beyond the stated requirement, so its licensing cost is unwarranted here. It is tempting because NGFWs do track connection state, but a stateful firewall already satisfies the IP, port and connection-state criteria.
Visual reference
Go deeper
Related to this question
Learn chapter
Secure Network Architecture and Design
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
TCP
TCP is a connection-oriented transport layer protocol that ensures reliable, ordered, and error-checked delivery of data between applications over IP networks.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.