A circuit-level proxy operates at the session layer (OSI Layer 5). It validates the TCP handshake and establishes a "circuit" for the session, then relays traffic between the two endpoints without inspecting the application-layer data payload. In contrast, an application-level proxy (Layer 7) acts as a full intermediary, terminating the client connection, deeply inspecting the application protocol's content (e.g., HTTP commands), and then initiating a separate connection to the server. This deep inspection requires significantly more computational resources, resulting in higher processing overhead and greater latency compared to the more lightweight circuit-level proxy.

B. more difficult to maintain.

Application-level proxies are more complex as they require specific proxy software and configuration for each application protocol, making them more difficult to maintain.

C. more secure.

Application-level proxies are more secure because they can inspect and filter application-layer content, preventing protocol-specific attacks that circuit-level proxies cannot see.

D. slower.

Due to its lower processing overhead from not inspecting application data, a circuit-level proxy is generally faster than an application-level proxy.

1. Stallings

W.

& Brown

L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson. In Chapter 21.2

"Firewall Characteristics

" the text explains that application-level gateways (proxies) add more processing overhead than circuit-level gateways.

2. National Institute of Standards and Technology (NIST). (2009). Special Publication 800-41 Revision 1: Guidelines on Firewalls and Firewall Policy. In Section 3.2

"Firewall Technologies

" it is noted that application-layer proxies "can be a performance bottleneck" due to the overhead of examining and forwarding all packets. In contrast

circuit-level proxies are described as simply relaying traffic without content examination

implying lower overhead.

3. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 8

Section 8.7.2

"Firewalls

" the text contrasts application gateways with packet filters

noting that the deep inspection performed by application gateways "incurs a performance penalty." This principle directly applies to the comparison with circuit-level proxies

which perform less inspection and are therefore faster.