At a bank, a network sensor stores the TLS handshake and the endpoint addresses but cannot read the file that was transferred. Which visibility challenge does that record show?
Select an answer to reveal the explanation.
Short Explanation
A sealed crate still shows the shipping label at the dock, but you cannot read the letter inside. You stored the TLS handshake and the addresses, and the file body stayed hidden by encryption. The trap is a missing disk, a wrong cloud bill, or a drop rule for a flow the sensor actually recorded.
Full Explanation
Network encryption leaves the handshake and the addresses visible and hides the bytes of the transferred file. That is the gap in Encryption on the path, hiding the file body while the handshake and addresses stay visible. A host with no disk, leaving nowhere for the transferred file to be stored after the session, would explain a missing local copy on a host, not a sensor that recorded the handshake and still cannot read the body. A cloud bill that is wrong, a charge that does not describe what this sensor was able to store, is an accounting error and does not decide whether payload bytes are readable. An access list that dropped the flow, despite the sensor having recorded the handshake already, cannot be the story, because a dropped flow would not leave a stored handshake and addresses for that transfer. Exam caveat: a sensor that holds the decryption key could read the body later; this record shows the encrypted view, with metadata kept and the file hidden. Operational check: confirm the stored record has the addresses and handshake details and no readable file bytes, then decide where a host record or a decryption point would add the body.