Which network security control operates at Layer 3-4 and filters traffic based solely on source IP, destination IP, protocol, and port without tracking connection state?

Why A is correct

A stateless packet filter (ACL) evaluates each packet in isolation using Layer 3-4 header fields: source/destination IP, protocol, and ports. It has no memory of prior packets and cannot distinguish a reply packet from an attack. Stateful firewalls track TCP connection state. NGFWs add Layer 7 deep packet inspection. IPS uses signatures and anomaly detection beyond simple header matching.