CISSP Communication and Network Security Practice Question
A network administrator is configuring a firewall that examines the source and destination IP addresses, port numbers, and protocol (TCP/UDP) of each packet without considering the state of the connection. Which type of firewall is being deployed?
⚠ Common exam trap
Watch out — candidates often confuse 'stateless packet filtering' with 'stateful inspection' because both examine IP/port/protocol, but the key differentiator is the lack of connection state tracking, which the question explicitly states by saying 'without considering the state of the connection.'
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Packet filter firewall
A packet filter firewall operates at Layer 3 (Network) and Layer 4 (Transport) of the OSI model, making decisions based solely on static header fields such as source/destination IP addresses, port numbers, and protocol type (TCP/UDP). It does not track connection state or session context, which matches the description of examining each packet independently. This is the defining characteristic of a stateless packet filter, as opposed to stateful or application-layer firewalls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Packet filter firewall
Why this is correct
A packet filter firewall operates at the network and transport layers (L3/L4) of the OSI model, making decisions solely based on static rules applied to IP addresses, port numbers, and protocols found in packet headers. It is inherently stateless, meaning it does not maintain information about ongoing connections, treating each packet individually without regard for its relationship to previous or subsequent packets. This simplicity allows for high performance but offers limited security context, as it cannot dynamically permit return traffic or detect complex attacks.
- ✗
Next-generation firewall
Why it's wrong here
A Next-Generation Firewall (NGFW) extends beyond traditional packet filtering and stateful inspection by incorporating deep packet inspection (DPI) and application awareness. NGFWs can identify and control applications regardless of port or protocol, integrate intrusion prevention systems (IPS), and leverage threat intelligence feeds to detect sophisticated, multi-vector attacks. This advanced capability allows for more granular security policies based on user identity, application type, and content, far exceeding simple header examination.
- ✗
Stateful inspection firewall
Why it's wrong here
A stateful inspection firewall significantly enhances security over stateless packet filters by maintaining a 'state table' that tracks active network connections. When an outbound connection is initiated, the firewall dynamically creates a temporary rule in its state table to permit the corresponding inbound return traffic, such as responses to web requests or FTP data transfers. This eliminates the need for explicit inbound rules for return traffic, making it more secure and efficient than stateless filtering, as it only allows legitimate responses to established sessions.
- ✗
Application proxy firewall
Why it's wrong here
An application proxy firewall, also known as a gateway firewall, operates at the application layer (Layer 7) of the OSI model by acting as an intermediary between clients and servers. It terminates both the client's connection and the server's connection, inspecting the actual application-layer payload for protocol compliance and malicious content before forwarding legitimate requests. This deep inspection provides superior security by understanding application-specific commands and data, but it introduces latency and requires a separate proxy for each application protocol.
Visual reference
Go deeper
Related to this question
Learn chapter
Secure Network Architecture and Components
Key term
OSI model
The OSI model is a conceptual framework that standardizes the functions of a telecommunication or computing system into seven distinct layers, from physical hardware to application software.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.