Which feature describes a firewall that tracks the state of active connections to permit dynamic filtering?

• A. NAT
• B. SPI
• C. VPN
• D. IDS

Answer: (B)

Stateful inspection, used by modern firewalls, keeps track of active connections in a state table. As packets arrive, it checks whether each packet belongs to an existing, allowed connection or if it’s initiating a new one. If a packet is part of a tracked connection, it can be allowed without rechecking all header fields; if it’s a new connection, the firewall applies rules to decide whether to permit it. This context-aware filtering is dynamic because decisions rely on the connection’s state, not just on individual packet headers. NAT translates addresses, which isn’t about tracking connection state for filtering; VPN provides encrypted tunnels; IDS detects potential threats but doesn’t enforce per-connection filtering in real time.