a) How is an application-layer gateway (ALG) different from a firewall?

The default Windows Firewall also monitors the Application layer

A firewall generally works at layer 3 and 4 of the OSI model. Layer 3 is the Network Layer where IP works and Layer 4 is the Transport Layer, where TCP and UDP function.

Many firewalls today have advanced up the OSI layers and can even understand Layer 7 - the Application Layer.

Stateful firewall checks more than just the ACK flag;it inspects the sequence numbers to ensure the correct state of the TCP session.

Maybe it uses false addresses to the external IP