nerdexam
Cisco

210-250 · Question #44

Which two tasks can be performed by analyzing the logs of a traditional stateful firewall? (Choose two.)

The correct answer is A. Confirm the timing of network connections differentiated by the TCP 5-tuple D. Map internal private IP addresses to dynamically translated external public IP addresses. A traditional stateful firewall tracks connection state using the TCP 5-tuple and can log NAT translations, but cannot inspect application-layer content, user identities, or malware.

Security Technologies

Question

Which two tasks can be performed by analyzing the logs of a traditional stateful firewall? (Choose two.)

Options

  • AConfirm the timing of network connections differentiated by the TCP 5-tuple
  • BAudit the applications used within a social networking web site.
  • CDetermine the user IDs involved in an instant messaging exchange.
  • DMap internal private IP addresses to dynamically translated external public IP addresses
  • EIdentify the malware variant carried by ^n SMTP connection

How the community answered

(31 responses)
  • A
    71% (22)
  • B
    3% (1)
  • C
    10% (3)
  • E
    16% (5)

Why each option

A traditional stateful firewall tracks connection state using the TCP 5-tuple and can log NAT translations, but cannot inspect application-layer content, user identities, or malware.

AConfirm the timing of network connections differentiated by the TCP 5-tupleCorrect

Stateful firewalls maintain a connection state table keyed on the TCP 5-tuple - source IP, destination IP, source port, destination port, and protocol - along with timestamps, so logs can confirm the timing and identity of network connections.

BAudit the applications used within a social networking web site.

Auditing specific applications used within a website requires application-layer (Layer 7) inspection, which is a next-generation firewall (NGFW) capability, not available in traditional stateful firewalls.

CDetermine the user IDs involved in an instant messaging exchange.

Identifying user IDs in an instant messaging exchange requires deep packet inspection and user-identity awareness, neither of which a traditional stateful firewall provides.

DMap internal private IP addresses to dynamically translated external public IP addressesCorrect

Firewalls that perform Network Address Translation (NAT) log mappings between internal private IP addresses and the external public IP addresses they are translated to, making this information recoverable from firewall logs.

EIdentify the malware variant carried by ^n SMTP connection

Identifying malware variants in SMTP traffic requires content inspection and signature matching performed by IDS/IPS or email security gateways, not a stateful firewall.

Concept tested: Stateful firewall log analysis capabilities and limitations

Source: https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/S/asa-command-ref-S.html

Topics

#stateful firewall#log analysis#TCP 5-tuple#NAT

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 210-250 Practice