________ firewalls always examine application messages in depth.

• A. Static packet filtering
• B. SPI
• C. Application proxy
• D. All of the above

Answer: (C)

Deep inspection of application-layer data is a hallmark of an application proxy firewall. It sits in line as a mediator, terminates the client's connection, and communicates the application protocol with both the client and the server in separate sessions. By understanding the protocol, it can parse requests and responses, examine commands, headers, and payloads, and enforce policies at the content level. This lets it detect and block malicious inputs that would slip past lower-layer firewalls.

Static packet filtering looks only at basic header fields like source, destination, ports, and IPs, so it cannot inspect the actual application data. Stateful packet inspection tracks connections and ensures sequences are valid, but it operates mainly at the transport layer and does not parse most application protocols in depth. Because of that, those approaches can’t reliably examine application messages in depth like an application proxy can.