In ingress and egress filtering, an SPI firewall always considers its ACL rules when a new packet arrives that attempts to open a connection.

• A. Yes
• B. No
• C. Only for inbound
• D. Only for outbound

Answer: (A)

Stateful (SPI) firewalls rely on the connection state table and require that the first packet of a new connection be permitted by ACL rules before a state entry is created. This check applies to both directions: an inbound attempt to open a connection and an outbound one. If the initial packet passes the ACL, the firewall records the connection state and allows subsequent packets as part of that established connection; if not, the connection is blocked. Therefore, for any new packet trying to establish a connection, the ACL is consulted regardless of whether the traffic is entering or leaving the network.