Which firewall type is described as inspecting both network-layer packets and application-layer contents to determine if a session is legitimate?

• A. Packet Filtering Firewall
• B. Stateful Multilayer Inspection Firewalls
• C. Circuit-Level Gateway Firewall
• D. NAT

Answer: (B)

Understanding how a firewall validates sessions and inspects traffic across layers helps explain why this type is the right choice. A stateful multilayer inspection firewall keeps track of each active connection, maintaining context such as the handshake state and allowed protocol behavior. At the same time, it examines the packet contents beyond just the headers, looking into application-layer data to verify that the traffic adheres to expected protocol semantics and to detect potentially malicious payloads. This combination lets it determine if a session is legitimate and to block anomalies that would slip past a simpler filter.

This approach is more capable than a basic packet-filtering firewall, which only checks header information (like IPs and ports) and does not maintain session state or inspect the data payload. It’s also more thorough than a circuit-level gateway, which ensures a session exists at the session layer but doesn’t perform deep inspection of application data. NAT focuses on translating addresses and does not evaluate traffic for session legitimacy based on content.