Which feature is commonly included in a unified threat management (UTM) firewall besides antivirus and spam filtering?

• A. NAT
• B. SPI
• C. VPN
• D. DDoS protection

Answer: (B)

Unified threat management devices integrate multiple protective functions into a single appliance, and a key capability they rely on is inspecting traffic with awareness of connection state. This stateful packet inspection tracks ongoing sessions and ensures that only packets that belong to valid, established connections are allowed through. That ongoing monitoring gives the firewall context about each packet, helping to block spoofed traffic, unusual connection attempts, and other forms of abuse, which is why it’s a staple feature alongside antivirus and anti-spam in UTMs.

NAT translates addresses and helps with routing, but it isn’t primarily a security inspection feature. VPN support is common on UTMs for providing secure remote access, but it’s more about creating encrypted tunnels than inspecting traffic for each packet’s legitimacy. DDoS protection is less universally included as a core feature of UTMs, often offered as an optional or higher-end capability. The stateful inspection capability is the one that most directly complements antivirus and spam filtering to improve overall inline security.