Stateful inspection is a firewall technology introduced in Checkpoint VPN-1/Firewall-1 software. It
is designed to meet which if the following security requirements?
1. Scan information from all layers in the packet.
2. Save state information derived from previous communications, such as the outgoing Port
command of an FTP session, so that incoming data communication can be verified against it.
3. Allow state information derived from other applications access through the firewall for
authorized services only, such as previously authenticated users.
4. Evaluate and manipulate flexible expressions based on communication and application derived
state information.
A.
1, 2, 3
B.
1, 3, 4
C.
1, 2, 4
D.
2, 3, 4
E.
1, 2, 3, 4
Explanation:
statefull inspection technology provides all these security features, as answer A says you can
analyze the packet from layer 2 to layer 7 to get the most information from the encapsulation
process including the application data content of the packet itself, the technology also manages
session information for the services for security verifications through matching connection internal
databases, it can also evaluate flexible expressions derived from information of various
applications and can also provide authentication capabilities embedded in the technology.
In the checkpoint implementation of the statefull inspection technology, the inspect engine is
placed at the top of the layer 2 of OSI model.
Incorrect Answers:
A: This is only part of the features of statefull inspection.
B: This is only part of the features of statefull inspection.
C: This is only part of the features of statefull inspection.
D: This is only part of the features of statefull inspection.