At a university, a security record shows the user, the full URL, the category, and a block decision. Which technology produced that record?
Select an answer to reveal the explanation.
Short Explanation
A front desk that writes the visitor's name, the exact room requested, the visit type, and a refusal is not a turnstile counter. You have the user, the full URL, the category, and a block, so this is a proxy log. The trap is a flow record, a signature with no URL, or a switch address table.
Full Explanation
A proxy log recording the user, the full URL, the category, and the block decision is the record that carries a user, a full URL, a category, and a block. A proxy sees the web request after it can read the URL, assigns a category, and logs the decision to block or allow. Those four fields together are a proxy log, not a summary of packets. A NetFlow record of addresses, ports, and byte counts, with no URL and no user name has addresses, ports, and byte counts. It has no URL and no user name. A flow record can show that a host talked to a web server. It cannot show the full URL or the category that justified a block. An intrusion prevention signature that names an attack pattern and a severity, but no URL names an attack pattern and a severity. An intrusion signature can block without ever storing a URL. The university record's full URL and category are not signature fields, and no attack-pattern name is given. A switch MAC address table that maps a hardware address to one switch port on the closet switch maps a hardware address to a switch port. That table answers where a device is plugged in. It has no user, no URL, no category, and no block decision. Exam caveat: an intrusion signature can block a flow and still have no URL. The presence of the full URL plus a category is what makes this a proxy record. Operational check: confirm the university event fields include the user, the full URL, the category, and the block, and that a flow export of the same minute does not contain the URL.