Which firewall element checks if the packet has SYN, ACK, or other bits set for establishing a connection?

Which firewall element checks if the packet has SYN, ACK, or other bits set for establishing a connection?

• A. Interface
• B. TCP code bits
• C. Source IP address
• D. Protocol in use

Answer: (B)

Inspecting TCP header flags to determine connection state is what enables a firewall to recognize a connection attempt and track the session. The TCP header contains control bits like SYN and ACK that show where a packet is in the handshake or in a connection’s lifecycle. By checking these TCP code bits, the firewall can distinguish a new connection request from packets belonging to an established connection and enforce appropriate rules. That’s why this option is the best match: it explicitly refers to evaluating the TCP flags that signal how a connection is being established. The interface just indicates where traffic enters, the source IP address is only part of the addressing and can be spoofed, and the protocol in use may identify TCP but doesn’t examine the flag state that marks the handshake.

Inspecting TCP header flags to determine connection state is what enables a firewall to recognize a connection attempt and track the session. The TCP header contains control bits like SYN and ACK that show where a packet is in the handshake or in a connection’s lifecycle. By checking these TCP code bits, the firewall can distinguish a new connection request from packets belonging to an established connection and enforce appropriate rules. That’s why this option is the best match: it explicitly refers to evaluating the TCP flags that signal how a connection is being established. The interface just indicates where traffic enters, the source IP address is only part of the addressing and can be spoofed, and the protocol in use may identify TCP but doesn’t examine the flag state that marks the handshake.