A government agency sees the user failure at the moment the endpoint flips from a wired connection to wireless. Which rule should catch that change?
Select an answer to reveal the explanation.
Short Explanation
If the lights fail at the instant someone flips the room from one circuit to another, you watch the switch. You alert when the endpoint changes from wired to wireless, because that flip is when the failure shows up. A BGP rule, a core SNMP alarm, or a weekly mail that ignores how the client connects is looking at the wrong panel.
Full Explanation
The failure lines up with the endpoint moving from wired connectivity to wireless, so the rule has to see that connectivity change on the client. An alert on the endpoint change from wired to wireless matches the end-user evidence and can page at the flip. A BGP-state rule on routers that do not record the client connectivity flip watches routing sessions and has no view of whether the laptop just left the dock. An SNMP interface alarm on a core router sitting away from that endpoint watches a core interface, not the access method on the client, so it stays quiet through a local flip or fires for unrelated reasons. A weekly executive mail that never watches how the client is connected is a delayed briefing and does not evaluate the wired-to-wireless transition. Exam caveat: connectivity-type changes are an endpoint signal; core routing and interface alarms do not substitute for them. Operational check: mark the timestamp of the wired-to-wireless transition on the endpoint and confirm the rule fires from that transition rather than from BGP state or a core interface counter.