A packet-filtering firewall evaluates the network-layer headers (IP, TCP/UDP/ICMP) of each packet and applies rules that “permit” or “deny” traffic based on source/destination addresses, protocol type, and—critically—TCP or UDP port (service) numbers. Administrators therefore create rules that open only the port numbers explicitly authorized for business-necessary applications and block all others. By design, the firewall does not knowingly allow unauthorized or undefined ports, nor does it deal with vague “ex-service” or “integer” concepts; thus option A precisely states its selective-allow capability.

B. “Unauthorized” ports are explicitly blocked, not enabled, by packet-filtering policy.

C. “Ex-service numbers” is not a recognized networking term; statement is imprecise.

D. Although ports are integers, “service integers” is non-standard phrasing; answer is vague and less accurate than A.

1. NIST Special Publication 800-41 Rev.1

“Guidelines on Firewalls and Firewall Policy

” §3.1.2 Packet-Filtering Firewalls

pp. 19-20.

2. W. R. Cheswick

S. M. Bellovin & A. D. Rubin

“Firewalls and Internet Security

” 2nd ed.

Addison-Wesley

2003

Ch. 6

pp. 181-182.

3. Cisco Systems

“IP Access List Overview

” Cisco IOS 15 Configuration Guide

§“Standard vs. Extended ACLs

” 2021

para. 2.

4. Stanford University CS244E

“Firewalls and Packet Filtering” lecture notes

Slide 8

2020.