At a bank, the team must block command-and-control packets on the path, and merely recording a copy of those packets will not perform the block. Which statement is accurate?
Select an answer to reveal the explanation.
Short Explanation
A copy machine cannot shred the original, no matter how sharp the copy looks. You need an inline device that can drop the original command-and-control packet. The trap is assigning that drop to a tap, to NetFlow, or to a SIEM rule.
Full Explanation
Blocking the original packet requires a device on the forwarding path that can discard it. An inline device is in that path. A tap copies, a flow exporter summarizes, and a SIEM judges records it has already received. Those three do not drop the packet that is still on the wire. "An inline device can drop the original command-and-control packet on the forwarding path". An inline device is on the forwarding path and can discard the original packet, which is the block the bank needs. "A network tap can drop the original command-and-control packet before the packet reaches the bank host". A tap copies traffic for a sensor. The copy operation leaves the original packet on its path, so the tap cannot perform this block. "A NetFlow exporter can drop the original command-and-control packet before it reaches the host". A flow exporter sends a summary of a conversation. Exporting counters does not discard the original packet. "A SIEM correlation rule can drop the original command-and-control packet while it is still on the wire". A SIEM correlation rule evaluates records the platform has collected. It is not on the forwarding path and does not drop the packet while that packet is on the wire. Exam caveat: a tap remains useful when you need payload, and payload visibility is not the ability to drop the original packet. Operational check: send a test packet that matches the block and confirm it does not arrive at the bank host, rather than only appearing in a log.