At a hotel, a firewall log shows an allowed TCP session from a guest laptop to port 443 and says nothing about the website or the application. Which source produces a record limited to that connection?
Select an answer to reveal the explanation.
Short Explanation
A door log that says admitted, side entrance, never records the guest's errand. Your hotel firewall line for an allowed session to port 443 is that kind of record: the connection, not the site or the application. Names, categories, and mail verdicts are written by other controls.
Full Explanation
A traditional stateful firewall tracks connection state: the addresses, the ports, the protocol, and whether the session was allowed. It does not have to name the website or the application riding a well-known port. The hotel line matches that limit. A traditional stateful firewall record of an allowed TCP session, with the connection only and no site or application. Application identification would have filled the blank the analyst is staring at. Application visibility and control that names the website or application inside the guest session would not leave the log as a bare allow to port 443. A browsing control would have classified the destination. A web-content filter record that assigns a site category and records the allow or deny for that guest is a different device and a different set of fields. Mail inspection is further from this session. An email-security verdict that names the attachment and the phishing disposition on a guest message requires a message and an attachment, and this TCP allow line has neither. Exam caveat: port 443 invites a guess of encrypted web traffic, but a port guess is not application identification, and the exam treats the stateful connection log as a separate source from application and web logs. Operational check: take one guest 5-tuple from this firewall line and find the same tuple in the application or web-filter log to see the name or category this record left out.