Even though answer 'D' can be technically correct, without any additional information on the overall network and business that the firewall is going to be implemented, a more vague answer (B) is preferable. I'm not going into the details explaining my line of thought stated above, other than providing a link to an article that juxtaposes the two main types of network firewalls (in the real world though, life is unfortunately not so clear-cut -- but a good starter-point for those willing to dig deeper in the fascinating world of firewalls). Stateless Vs. Stateful Packet Filtering Firewalls: Which is Better? https://www.lanner-america.com/blog/stateless-vs-stateful-packet-filtering-firewalls-better/ In a nutshell though, the risks and long-term costs of maintaining a network security for any business type, any network security administrator worth their salt would by default implement a network-based firewall with at least some rudimentary stateful capabilities.