Which of the following is a feature of a stateful inspection firewall?

A stateful inspection firewall maintains a "state table" to track the status of all active network connections. Unlike a stateless firewall that examines packets in isolation, a stateful firewall understands the context of a packet within a communication session (e.g., TCP handshake). This allows it to make more intelligent filtering decisions, such as permitting only return traffic that matches an outgoing request. This capability enables it to detect and block more sophisticated attacks that exploit network protocol states, such as port scanning or denial-of-service attacks, which a stateless firewall would miss.

A. Both stateless and stateful firewalls track destination IP addresses; this is a basic packet filtering function, not a distinguishing feature of stateful inspection.
C. No single network device, including a firewall, can prevent all insider attacks, which often involve legitimate credentials and bypass perimeter defenses.
D. Translating MAC addresses to IP addresses is a function of the Address Resolution Protocol (ARP) at Layer 2/3, not a primary feature of a firewall.

1. National Institute of Standards and Technology (NIST). (2005). SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy. Section 2.2.2 states, "Stateful inspection firewalls... are an improvement over static packet filters because they can track the state of a connection and block packets that deviate from the expected state."

2. Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. Chapter 8.6.2 describes stateful firewalls as keeping track of TCP connections, allowing them to "distinguish between packets that are part of an established connection and packets that are attempting to establish a new connection."