At a bank, outbound port 443 from a workstation is allowed, and a new listening port that a script just opened is denied. Which technology enforced that decision?
Select an answer to reveal the explanation.
Short Explanation
The latch on your own workstation, not the camera down the hall, is what refuses a new inbound knock. Outbound port 443 was allowed and a new listening port was denied, which is a host firewall. The trap is a hash quarantine, an alert that does not block, or a capture that only stores packets.
Full Explanation
A host-based firewall on the workstation that allowed outbound port 443 and denied the new listening port the script opened enforced the decision. A host-based firewall on the workstation permits and denies traffic for that PC. It allowed outbound port 443 and denied the new listening port the script opened. Those are port decisions applied on the host, which is what a host firewall is for. Antivirus that matched a known-bad hash and quarantined a file before the file could run matches a known-bad hash and quarantines a file before it runs. The scenario's action is an allow and a deny on ports, not a file hash and not a quarantine. A SIEM correlation rule that raised an alert and did not block the new listening port can notice the new listener and raise an alert. The scenario says the listening port was denied, and a correlation rule that does not block the port did not perform that deny. Alerting and enforcing are different outcomes. Full packet capture that stored the bytes of the attempt and did not enforce any port decision stores the bytes of what was sent. A capture is a record. It does not allow outbound 443 or deny a new listen, so it cannot be the control that enforced the decision. Exam caveat: a SIEM can tell you a new listener appeared, but the deny itself is the host firewall. Do not credit the alert system with a block it did not perform. Operational check: on the workstation, identify the rule that permits outbound port 443 and the rule that denies the new listening port.