At a retailer, one store server is mining while it exchanges traffic only with a second store server. That east-west conversation stays on the store LAN and never crosses the internet firewall. Which deployment can still observe that pair?
Select an answer to reveal the explanation.
Short Explanation
You can observe the mining where the east-west traffic actually travels: with a host agent or internal sensor on the store LAN. The internet-edge deny log, public DNS filter, and badge-reader log each miss it for a different reason, so keep placement in view.
Full Explanation
The mining pair stays on the store LAN, so the deployment that can observe it is a host agent or internal sensor on that path. It can see the east-west conversation between the two servers, which the internet firewall never receives. The internet-edge deny log records only packets that arrive at the perimeter firewall and are dropped; because this exchange never reaches the firewall, that log cannot capture it. A public DNS filter labels names resolved for web browsing, but it does not observe this server-to-server conversation. The building badge-reader log records door events, not packets, so it has no visibility into the mining traffic. The key concept is placement: a control can observe traffic only if it is on the host or network path that traffic uses. Exam caveat: an internet-edge control retains the same blind spot when traffic stays entirely inside the store LAN. Practical check: confirm that an internal sensor receives a traffic copy on the store LAN, or that a host agent is present on one of the two servers, and verify that it recorded their conversation during the relevant time window.