Which type of firewall works at all layers of the OSI model?

Which type of firewall works at all layers of the OSI model?

• A. Stateful Inspection
• B. Packet Filtering
• C. Application Proxy
• D. Next-Generation Firewall

Answer: (A)

Understanding how firewalls use state and context helps explain why a stateful inspection firewall is described as operating across the OSI stack. Stateful inspection keeps track of each active connection and the progress of that connection, so decisions aren’t made on a single packet in isolation. This requires awareness of the session as it unfolds, which inherently involves information from multiple layers—from the transport layer that manages the connection to higher-layer protocol behavior in the course of a session. By maintaining this state, the firewall can enforce rules based on how a connection starts, progresses, and ends, effectively applying policy across the flow of traffic that traverses many layers. Stateless packet filtering, by contrast, looks at individual packets without context, largely limiting its view to network and transport header fields. An application proxy operates at higher-layer protocols by acting as an intermediary for specific applications, providing deep inspection for those protocols but not universal cross-layer awareness. A next-generation firewall adds broad capabilities, including application-layer features and advanced threat protection, but the classic description of spanning all OSI layers through ongoing session context is most closely associated with stateful inspection’s approach to traffic.

Understanding how firewalls use state and context helps explain why a stateful inspection firewall is described as operating across the OSI stack. Stateful inspection keeps track of each active connection and the progress of that connection, so decisions aren’t made on a single packet in isolation. This requires awareness of the session as it unfolds, which inherently involves information from multiple layers—from the transport layer that manages the connection to higher-layer protocol behavior in the course of a session. By maintaining this state, the firewall can enforce rules based on how a connection starts, progresses, and ends, effectively applying policy across the flow of traffic that traverses many layers.

Stateless packet filtering, by contrast, looks at individual packets without context, largely limiting its view to network and transport header fields. An application proxy operates at higher-layer protocols by acting as an intermediary for specific applications, providing deep inspection for those protocols but not universal cross-layer awareness. A next-generation firewall adds broad capabilities, including application-layer features and advanced threat protection, but the classic description of spanning all OSI layers through ongoing session context is most closely associated with stateful inspection’s approach to traffic.