At a bank, a log names the application, the user, and an intrusion verdict, in addition to the port. Which technology produced that log?
Select an answer to reveal the explanation.
Short Explanation
A modern checkpoint writes the cargo type, the driver, and whether the load looked hostile, not only the lane. You have the application, the user, and an intrusion verdict, so this is a next-generation firewall log. The trap is a tuple-and-verdict stateful record, a copy of packets with no judgment, or an address lease.
Full Explanation
A next-generation firewall log that names the application, the user, and an intrusion verdict is the log that names the application, the user, and an intrusion verdict beyond the port. A next-generation firewall still sees the connection, and it adds application identification, user identity, and an intrusion verdict. A traditional stateful firewall log that holds the connection tuple and an allow or deny, and nothing past that holds the connection tuple and an allow or deny, and nothing past that. A traditional stateful firewall tracks the connection and permits or denies it. It does not add the application name, the user, and an intrusion verdict. A span port that copies packets for later inspection and adds no application name or intrusion verdict copies packets for later inspection. The copy adds no application name and no intrusion verdict of its own. A DHCP lease that records an address assignment, a subnet mask, and a lease time for one bank host records an address assignment, a mask, and a lease time. It does not name an application, a user of a session, or an intrusion verdict. Exam caveat: a next-generation firewall log still contains the connection fields. Application, user, and intrusion verdict are the extras that separate it from a traditional stateful log that stops at the tuple and the allow or deny. Operational check: open the bank event and confirm the application, the user, and the intrusion verdict are populated, not only the 5-tuple and an allow or deny.