Which three states does a stateful inspection firewall track for TCP traffic, according to NIST SP 800-41? Choose three.

Answer: B. Connection establishment.
D. Usage of the established connection.
C. Termination, including a connection idle for a long period.

SP 800-41 names three major states for TCP traffic: connection establishment, usage, and termination, the last covering both a requested close and prolonged inactivity.

Source: NIST SP 800-41 Rev. 1 (NIST) — SP 800-41 Rev. 1 > 2.1.2 Stateful Inspection