Which SPI firewall rule applies to packets that do not attempt to open connections?

• A. Drop the packet unless it is permitted by an ACL
• B. Pass the packet if it is part of a previously approved connection
• C. Pass the packet unless it is forbidden by an ACL
• D. Either A or B

Answer: (B)

Stateful inspection tracks active connections. When a connection has already been established, the firewall treats packets that are part of that connection as legitimate traffic and allows them based on the existing state, without needing a new ACL check. This is why a packet that isn’t trying to open a new connection is allowed if it belongs to a previously approved connection—the firewall simply references the connection’s state and passes it along.

An ACL-only rule would require re-evaluating each packet, and a default pass or drop rule without considering the state wouldn’t reflect how stateful firewalls handle ongoing sessions. So the correct approach is to pass the packet if it’s part of a previously approved connection.