Session-based stateful inspection firewalls process the first and subsequent packets in different ways. Which of the following statements are correct?

Session-based stateful inspection firewalls process the first and subsequent packets in different ways. Which of the following statements are correct?(multiple choice)

A. When receiving a packet, a firewall searches the session table. If no entry matches, the firewall processes the packet as the first packet.

B. When receiving a packet, a firewall searches the session table. If no entry matches, the firewall processes the packet as a subsequent packet

C. When the stateful inspection mechanism is enabled, a firewall checks subsequent packets using the security policy.

D. When the stateful inspection mechanism is enabled, a firewall creates sessions only for SYN packets in TCP flows.