A dynamic packet-filtering firewall, also known as a stateful inspection firewall, operates by maintaining a state table that tracks active network connections. When an internal client initiates an outgoing request, the firewall adds an entry to this table with details like source/destination IP addresses and port numbers. It then dynamically creates a temporary rule allowing the expected incoming reply packets that match the state table entry. Once the session terminates, the entry and its associated temporary rule are removed. This mechanism is precisely what is described in the question.

A. packet filtering: This is a stateless firewall that evaluates each packet in isolation against a static access control list (ACL) and does not track connection states.
B. Circuit level proxy: This firewall validates TCP handshakes at the session layer but does not typically inspect individual packets or create dynamic packet-level ACLs in this manner.
D. Application level proxy: This firewall acts as an intermediary for specific applications (e.g., HTTP), inspecting content at the application layer, which is a different and more complex mechanism.

1. National Institute of Standards and Technology (NIST) Special Publication 800-41 Revision 1, Guidelines on Firewalls and Firewall Policy. Section 2.1.2, "Stateful Inspection Firewalls," states: "Stateful inspection firewalls... are able to determine if a packet is part of an existing, valid connection... When a connection is initiated, the firewall adds the connection to its state table. From that point forward, any packets that are part of that connection are allowed to pass without being re-evaluated against the rule set." This describes the dynamic allowance of return traffic.

2. Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. In Chapter 8.6.1, "Firewalls," the text describes stateful packet filters: "A stateful filter tracks the state of TCP connections... The filter can then determine whether an arriving TCP segment is a legitimate part of an established connection... or is a bogus TCP segment." This tracking and dynamic allowance based on connection state is the core of the question.

3. Stallings, W., & Brown, L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson. In Chapter 21.1, "Firewall Characteristics," the text differentiates between static packet filters and stateful inspection firewalls, explaining that the latter "maintains a directory of outbound TCP connections... An entry is made for each established connection. The packet filter will now allow incoming traffic to high-numbered ports only for those packets that fit the profile of one of the entries in the directory." This directly supports the chosen answer.