Study. uk . com
  1. Home
  2. All questions
  3. Question 263

CISSP study material · question 263 of 500

A stateful firewall permits an inbound DNS response from an external server. On what basis does it do so, and what limits its handling of that traffic?

  1. It matches the reply to a prior outbound query by address and port, and must expire the entry on a timer because there is no session end to observe.
  2. It treats DNS as connectionless and permits it unconditionally.
  3. It tracks the DNS transaction identifier as a connection state machine.
  4. It inspects the DNS payload and permits well-formed answers regardless of prior queries.
Show the answer

Answer: A. It matches the reply to a prior outbound query by address and port, and must expire the entry on a timer because there is no session end to observe.

UDP has no connection setup, so tracking is by address and port with a timeout; the reply passes only because the outbound query was seen.

Source: NIST SP 800-41 Rev. 1 (NIST) — SP 800-41 Rev. 1 > 2.1.2 Stateful Inspection

Challenge yourself on this topic → Study as cards