What is the correct characterization of stateful versus stateless firewalls?

• A. Stateful tracks connection state and context; example: most enterprise firewalls.
• B. Stateless monitors and blocks all traffic by default.
• C. Stateless uses static ACLs; example: routers.
• D. Stateful uses static ACLs; example: routers.

Answer: (A)

Stateful vs stateless rests on whether the firewall remembers the state of connections. A stateful firewall keeps track of active conversations in a state table, recording who’s talking to whom, which ports and protocols are used, and whether a connection is established. When a packet arrives, it’s checked against that context, so return traffic for an allowed connection can pass without a separate rule. This remember-and-apply approach is why enterprise firewalls are stateful—it lets policies reflect actual connections and traffic flows.

A stateless firewall inspects each packet on its own, applying fixed rules or ACLs without regard to previous packets or ongoing sessions. It doesn’t know if a packet is part of an existing connection, which makes it simpler and sometimes faster, but less capable of handling modern, connection-oriented traffic.

So, the best characterization is that stateful firewalls track connection state and context, a hallmark of most enterprise firewalls.