For packets that are part of an ongoing connection, which rule would apply?

• A. Drop unless permitted by an ACL
• B. Pass the packet if it is part of a previously approved connection
• C. Pass the packet unless forbidden by an ACL
• D. Either A or B

Answer: (B)

Stateful inspection keeps track of active connections. Once a connection is established and permitted, the firewall marks it as approved, so subsequent packets that belong to that same connection are allowed automatically. This is why the appropriate rule is to pass the packet if it is part of a previously approved connection—the router isn’t re-checking a fresh ACL for every packet, it recognizes the ongoing session and permits related traffic.

Dropping all packets unless an ACL explicitly permits them ignores how the firewall handles established sessions, and passing everything unless an ACL blocks it would be far too permissive and unsafe. The “either A or B” option isn’t accurate because established-connection behavior is a specific, stateful rule, not a combination of the two stateless approaches.