You work as a Chief Security Officer for Tech Perfect Inc. The company has a TCP/IP based network. You want to use a firewall that can track the state of active connections of the network and then determine which network packets are allowed to enter through the firewall. Which of the following firewalls has this feature?

The question describes a firewall that tracks the state of active connections to make filtering decisions. This is the defining characteristic of a stateful inspection firewall. This type of firewall maintains a state table of all active connections, allowing it to make more intelligent decisions than a stateless filter by understanding the context of network traffic. For example, it can dynamically permit return traffic for a connection initiated from inside the network without a specific inbound rule. The term "Dynamic packet-filtering firewall" is a recognized synonym for a stateful inspection firewall, as it highlights the dynamic nature of the rule set, which is modified based on the connection state.

B. Proxy-based firewall: This operates at the Application layer (Layer 7), acting as an intermediary for specific protocols, rather than primarily tracking connection state at the Transport layer (Layer 4).
D. Application gateway firewall: This is another name for a proxy-based firewall and is incorrect for the same reason; its primary function is deep application-level inspection, not just state tracking.

1. National Institute of Standards and Technology (NIST) Special Publication 800-41 Revision 1, Guidelines on Firewalls and Firewall Policy. Section 2.2.2, "Stateful Inspection Firewalls," explicitly states: "Stateful inspection firewalls, which are the most common type of firewall in use today, are also known as dynamic packet filtering firewalls." This confirms the terms in options A and C are synonyms for the technology described.

2. Purdue University, Center for Education and Research in Information Assurance and Security (CERIAS). In course materials on network security, stateful inspection is described as a mechanism that "dynamically builds a state table" to track connections. This directly links the concepts of "stateful" and "dynamic" filtering. (Reference: General courseware principles on network security from institutions like Purdue's CERIAS).

3. Cheswick, W. R., & Bellovin, S. M. (1994). Firewalls and Internet Security: Repelling the Wily Hacker. Addison-Wesley. This foundational academic text on network security describes the evolution from static packet filters to more advanced firewalls that could understand the state of a TCP connection, which they termed "dynamic packet filters" (Chapter 6). This establishes the historical and technical validity of the term.