Which type of firewall must you implement to ensure that incoming connections are initiated by internal computers?

• A. Stateful firewall
• B. Packet filtering firewall
• C. Circuit-level proxy firewall
• D. Application-level proxy firewall

Answer: (A)

Tracking the state of connections is what determines that an inbound packet is part of a session started inside the network. A stateful firewall keeps a table of active connections and their contexts, so it can distinguish legitimate return traffic from unsolicited attempts. When an internal host initiates a connection outward, the firewall records that state and automatically allows the corresponding inbound responses, while blocking new, uninitiated inbound connections. This directly satisfies the requirement that incoming connections be initiated by internal computers.

Packet-filtering firewalls lack memory of connection state; they make decisions based only on static rules for individual packets, so they can’t reliably tie inbound traffic to an interior initiation. Circuit-level proxy firewalls route traffic through a proxy at the session level, which controls access but doesn’t inherently enforce that inbound connections are responses to interior requests. Application-level proxies add more control at the application layer but don’t inherently provide the session-state tracking that guarantees interior initiation of inbound traffic.