What is the difference between a stateful and a stateless firewall?

• A. Stateful monitors per-packet decisions without keeping connection state.
• B. Stateless tracks connection state and context.
• C. Stateful tracks connection state and context; Stateless makes decisions per packet without context.
• D. Both require full connection information to function.

Answer: (C)

The key idea is how context is used to decide whether a packet is allowed. A stateful firewall builds a record of each active connection—its state and related details—so it can recognize legitimate return packets and enforce policies based on how the connection is supposed to progress. With this connection context, the firewall can track sequences, validate handshakes, and drop packets that don’t fit the expected state. A stateless firewall, in contrast, looks at each packet in isolation and applies fixed rules without remembering any past traffic. It can be faster, but it lacks awareness of the overall conversation between hosts, making it easier for certain spoofed or out-of-order packets to slip through.

That distinction is why the best description is that a stateful firewall tracks connection state and context, while a stateless firewall makes decisions per packet without context. The other descriptions mix those ideas up or claim both types require full connection information, which isn’t accurate for a stateless approach.