How do new connections get established through a Security Gateway with SecureXL enabled?

A.
New connections are always inspected by the firewall and if they are accepted, the subsequent
packets of the same connection will be passed throughSecure XL

B.
The new connection will be first inspected bySecure XLand if it does not match the drop table
ofSecure XL, then it will be passed to the firewall module for a rule match.

C.
New connection packets never reach theSecure XLmodule.

D.
If the connection matches a connection or drop template inSecure XL, it will either be established
or dropped without performing a rule match, else it will be passed to the firewall module for a rule
match.