Which of the following statements about firewalls and SYN traffic is true?

• A. Not sure
• B. True
• C. Not applicable
• D. False

Answer: (B)

Firewalls treat TCP SYN traffic as the starting point of a connection and manage it through state information. When a host sends a SYN, a stateful firewall records that attempt in its connection table and tracks the progress of the three-way handshake. It typically won’t let traffic through until the handshake completes, or it will apply protections for half-open connections. This enables the firewall to detect and block unusual SYN activity, such as SYN flood attempts, by limiting new half-open connections or dropping suspicious packets. Many firewalls also use techniques like SYN cookies to respond to excessive SYN requests without committing resources until the handshake can be completed. Because firewalls actively manage SYN traffic to enforce security and performance, the statement is true.