Check Point Certified Security Administrator (CCSA) Practice Exam

In a stateful inspection system, what does the firewall primarily monitor?

1. Incoming data packets only.

2. Outgoing data packets only.

3. Established connections.

4. Unregistered traffic.

The correct answer is: Established connections.

A stateful inspection firewall primarily monitors established connections because it tracks the state of active connections and uses that information to determine which packets are allowed through the firewall. This type of firewall maintains a table that stores information about the state of each connection, including source and destination IP addresses, port numbers, and the connection's state (e.g., established, closing). By monitoring established connections, the firewall can effectively allow return traffic that is part of an ongoing session while blocking any unsolicited or potentially harmful traffic that does not correspond to an established connection. This intelligent analysis of connections enhances security by ensuring that only legitimate return traffic is permitted. In contrast, focusing solely on incoming or outgoing data packets would lack the contextual awareness of connections that stateful inspection entails. Monitoring unregistered traffic would also not provide the necessary context for allowing or blocking packets, which is integral to the operational effectiveness of a stateful firewall.