At a bank, a monitoring record names a signature identifier, a severity, and a drop action taken on a flow. Which technology produced that record?
Select an answer to reveal the explanation.
Short Explanation
A citation, a fine amount, and a vehicle pulled over are not the same as a traffic count. You have a signature, a severity, and a drop on a flow, so this came from intrusion detection or prevention. The trap is a flow summary, a laptop file hash, or an address lease.
Full Explanation
An intrusion prevention or detection system that matched a signature and dropped the flow is the sensor family that attaches a signature identifier and a severity to a flow and can drop that flow when it sits on the forwarding path. The bank record has all three of those fields. A signature is a known pattern, the severity is the sensor's rating of the match, and the drop is an inline action on the flow. A NetFlow record that summarizes the flow and carries no signature identifier or drop action summarizes who talked to whom and how much was sent. A flow summary does not carry a signature identifier, a severity, or a drop based on a pattern match. Antivirus on a laptop that matched a file hash and then quarantined the file matches a file hash on a laptop and quarantines that file. The bank record is about a flow, not a file, and it cites a signature identifier rather than a hash. A DHCP lease that assigned an address, a mask, and a lease timer to a bank host hands a host an address, a mask, and a lease time. Address assignment does not inspect a flow for a known attack pattern and does not drop one. Exam caveat: a drop means the sensor is on the forwarding path and can remove the packet it sees. A detection-only sensor can still emit a signature and a severity, but it cannot discard the original packet. Operational check: confirm the event contains the signature identifier, the severity, and the drop, and confirm that sensor is inline on the path where the drop occurred.