How do new connections get established through a Security Gateway with Secure XL enabled?

How do new connections get established through a Security Gateway with Secure XL enabled?
A . New connections are always inspected by the firewall and if they are accepted, the subsequent packets of the same connection will be passed through Secure XL
B . The new connection will be first inspected by Secure XL and if it does not match the drop table of Secure XL, then it will be passed to the firewall module for a rule match.
C . New connection packets never reach the Secure XL module.
D . If the connection matches a connection or drop template in Secure XL, it will either be established or dropped without performing a rule match, else it will be passed to the firewall module for a rule match.

Answer: D