Courseiva
hardMultiple SelectObjective-mapped

SSCP Practice Question: Which THREE of the following are characteristics…

Which THREE of the following are characteristics of a stateful firewall?

⚠ Common exam trap

ISC2 often tests the misconception that stateful firewalls perform deep packet inspection, but DPI is a separate capability of NGFWs, while stateful firewalls focus on session-layer tracking.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Is generally slower than a stateless firewall

Stateful firewalls maintain a state table that tracks the state of active connections, allowing them to make decisions based on the context of traffic patterns, such as the TCP three-way handshake. This additional processing overhead generally makes them slower than stateless firewalls, which only inspect packet headers individually without connection tracking.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Is generally slower than a stateless firewall

    Why this is correct

    Stateful inspection requires more processing.

  • Maintains a state table of active connections

    Why this is correct

    Stateful firewalls track connections to allow return traffic.

  • Can make decisions based on traffic patterns

    Why this is correct

    Uses context from previous packets.

  • Operates only at the network layer (Layer 3)

    Why it's wrong here

    Stateful firewalls operate at layers 3 and 4.

  • Performs deep packet inspection (DPI)

    Why it's wrong here

    DPI is a feature of next-generation firewalls, not basic stateful.

Visual reference

Client Server SYN (seq=100) SYN-ACK (seq=200, ack=101) ACK (ack=201) Connection established — data transfer begins

About these practice questions

One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.