nerdexam
Cisco

210-255 · Question #192

Refer to the exhibit. Which technology generates this log?

The correct answer is D. firewall. The log in the exhibit was generated by a firewall, identifiable by its characteristic fields showing source/destination IPs, ports, protocol, and a permit or deny action.

Security Monitoring

Question

Refer to the exhibit. Which technology generates this log?

Options

  • ANetFlow
  • BIDS
  • Cweb proxy
  • Dfirewall

How the community answered

(20 responses)
  • A
    10% (2)
  • B
    5% (1)
  • C
    5% (1)
  • D
    80% (16)

Why each option

The log in the exhibit was generated by a firewall, identifiable by its characteristic fields showing source/destination IPs, ports, protocol, and a permit or deny action.

ANetFlow

NetFlow records capture traffic flow statistics such as byte counts, packet counts, and flow duration but do not include policy enforcement actions like permit or deny.

BIDS

IDS (Intrusion Detection System) logs contain alert data tied to matched signatures or anomaly detections, not simple connection permit/deny records.

Cweb proxy

Web proxy logs focus on HTTP/HTTPS-layer transactions, recording URLs, HTTP methods, response codes, and content categories rather than generic network-layer connection decisions.

DfirewallCorrect

Firewall logs are distinguished by their access control entries, which record source IP, destination IP, source port, destination port, protocol, and the enforcement action taken (permit or deny/drop). This combination of fields reflects a security policy decision point, which is the defining characteristic of firewall-generated logs. No other listed technology produces logs with an explicit permit/deny action tied to 5-tuple connection data in this format.

Concept tested: Identifying firewall log format and characteristics

Source: https://www.cisco.com/c/en/us/td/docs/security/asa/asa916/configuration/general/asa-916-general-config/monitor-syslog.html

Topics

#firewall logs#log identification#log formats#log sources

Community Discussion

No community discussion yet for this question.

Full 210-255 Practice