Which SPI firewall rule applies to packets that only have their TCP ACK bits set but no other flags?

• A. Drop the packet unless it is permitted by an ACL
• B. Pass the packet unless it is forbidden by an ACL
• C. Pass the packet if it is part of a previously approved connection
• D. Either A or B

Answer: (C)

Stateful handling of TCP connections is what this question is about. An ACK-only segment, with no SYN or other flags, is a packet that belongs to an already established TCP connection. A firewall that does SPI (stateful) keeps a record of active connections and allows traffic that is part of those connections. Therefore, an ACK packet is allowed when it matches an existing, previously approved connection in the firewall’s state table. If there isn’t a matching connection, the firewall would drop it to prevent unsolicited or potentially harmful traffic.

That’s why the correct approach is: pass the packet if it is part of a previously approved connection. The other options either rely solely on ACLs without considering connection state or are too permissive, which isn’t how stateful inspection handles TCP traffic.