At a hotel, a server has no agent, the only clue is a firewall allow, and the process that ran is unknown. Which visibility gap does that leave?
Select an answer to reveal the explanation.
Short Explanation
You can see that a door was allowed to open, and you still have no camera on the person who walked through. The hotel server has no agent, so the unknown process behind the firewall allow is a host-visibility gap. The trap is asking for a packet capture, a cloud API audit, or a badge log.
Full Explanation
A firewall allow shows that a flow was permitted. Without an agent, the process that generated it is unknown, which is Missing host visibility, so the process behind the firewall allow stays unknown on this server. A missing full packet capture, the record that would show payload bytes inside the allowed flow, might reveal payload if the bytes were readable, and it still would not name the process the way a host sensor does. A missing cloud control-plane audit for provider API calls that do not apply to this server describes a provider API the hotel server is not using. A missing badge log, the record of who entered the room where the hotel server is racked, names a person at a door and does not name the process. The firewall allow shows the flow was permitted, so the open question is which process on the server generated it. Exam caveat: readable packets can still help with the payload question; the gap this case asks about is the unknown process, and that is host visibility. Operational check: look for an endpoint agent or a host log on that server, and treat the process as unknown until one of those records exists.