CISSP Communication and Network Security Practice Question
A security engineer is configuring a firewall that makes decisions based on source/destination IP addresses and port numbers without tracking the state of connections. Which type of firewall is this?
⚠ Common exam trap
Test-takers frequently confuse 'stateless packet filtering' with 'stateful inspection' because both examine IP addresses and ports, but the key differentiator is the absence of connection tracking in packet filters.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Packet filter firewall
A packet filter firewall operates at Layers 3 and 4 of the OSI model, making forwarding decisions solely based on static fields such as source/destination IP addresses and port numbers. It does not maintain any connection state table, meaning each packet is evaluated independently without reference to previous packets. This stateless behavior is the defining characteristic that distinguishes it from stateful inspection firewalls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Stateful inspection firewall
Why it's wrong here
A stateful inspection firewall, also known as a dynamic packet filter, maintains a state table for active connections. It tracks the source and destination IP addresses, port numbers, and sequence numbers for TCP sessions, allowing return traffic to pass without explicit outbound rules. This advanced capability goes beyond the basic IP/port filtering described, which doesn't mention tracking connection states.
- ✗
Application proxy firewall
Why it's wrong here
An application proxy firewall operates at the application layer (Layer 7 of the OSI model), acting as an intermediary for specific application protocols like HTTP or FTP. It terminates the connection from the client, inspects the application-layer payload for malicious content or policy violations, and then establishes a new connection to the destination server. This level of deep content inspection is far more sophisticated than merely filtering based on IP addresses and port numbers.
- ✓
Packet filter firewall
Why this is correct
A packet filter firewall, often referred to as a stateless firewall, makes forwarding decisions solely based on the information contained within the network and transport layer headers of individual packets. It examines source and destination IP addresses, source and destination port numbers, and protocol types against a predefined set of rules. This method is stateless, meaning it does not track the state of ongoing connections, perfectly matching the scenario's implied basic filtering criteria.
- ✗
Next-generation firewall
Why it's wrong here
A next-generation firewall (NGFW) integrates multiple security capabilities beyond traditional port/protocol inspection, including deep packet inspection, intrusion prevention systems (IPS), application awareness and control, and identity-based policies. While it can perform basic IP/port filtering, its core strength lies in its ability to understand and control applications regardless of port, and detect advanced threats, making it significantly more complex than the simple filtering described.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
OSI model
The OSI model is a conceptual framework that standardizes the functions of a telecommunication or computing system into seven distinct layers, from physical hardware to application software.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.