Check Point Certified Security Administrator (CCSA) Practice Exam

What is a key advantage of Stateful Inspection over Packet Filtering?

1. Stateful Inspection offers unlimited connections because of virtual memory usage.

2. Stateful Inspection offers no benefits over Packet Filtering.

3. Stateful Inspection does not use memory to record the protocol used by the connection.

4. Only one rule is required for each connection.

The correct answer is: Only one rule is required for each connection.

Stateful Inspection technology offers several advantages over traditional Packet Filtering, and one key benefit is that it requires only one rule for each connection. This is because Stateful Inspection keeps track of active connections and their states. It allows for a more intelligent and comprehensive approach to managing traffic, as it can understand the context of the packets within a connection — including the state of the connection (e.g., whether it is in the establishment, data transfer, or termination phase). In contrast, Packet Filtering often requires multiple rules for different types of traffic, as it examines each packet in isolation without regard to the state of the connection. This difference in methodology leads to a simpler and more efficient rule setup for firewalls using Stateful Inspection because the stateful firewall dynamically allows or denies packets based on the established state, meaning that once a connection is approved, subsequent packets related to that connection can be processed with less overhead. While other options present various statements, they do not encapsulate the core advantage of Stateful Inspection in terms of managing rules for connections effectively.