Study. uk . com
  1. Home
  2. All questions
  3. Question 257

CISSP study material · question 257 of 500

A border router applies access control lists that permit or deny packets by address and port. The security team asks why it cannot recognise that a reply belongs to a request it saw a moment earlier. What explains this?

  1. It inspects only the data link layer, where session information is absent.
  2. It reassembles fragments before matching, which destroys the session identifiers.
  3. It performs stateless inspection and keeps no record of traffic flows, so it cannot associate requests within one session.
  4. Its rules are evaluated in order and stop at the first match, discarding session context.
Show the answer

Answer: C. It performs stateless inspection and keeps no record of traffic flows, so it cannot associate requests within one session.

A pure packet filter is a stateless inspection device: it does not track the state of each flow and so cannot associate multiple requests within a single session.

Source: NIST SP 800-41 Rev. 1 (NIST) — SP 800-41 Rev. 1 > 2.1.1 Packet Filtering

Challenge yourself on this topic → Study as cards