Study. uk . com
  1. Home
  2. All questions
  3. Question 262

CISSP study material · question 262 of 500

An engineer inspects a firewall's state table and expects to find only addresses. Which further items does NIST SP 800-41 say such an entry typically holds? Choose two.

  1. The media access control address of the originating host.
  2. The state of the connection.
  3. The source and destination port numbers.
  4. The complete application payload of the first packet.
Show the answer

Answer: C. The source and destination port numbers.
B. The state of the connection.

State table entries typically include source and destination addresses, port numbers and connection state information, and often address translation details where the firewall performs translation.

Source: NIST SP 800-41 Rev. 1 (NIST) — SP 800-41 Rev. 1 > 2.1.2 Stateful Inspection

Challenge yourself on this topic → Study as cards