312-49V11 · Question #96
Sophia, a network security analyst, is reviewing the logs from a Cisco router in an attempt to identify suspicious traffic patterns. She encounters a log entry that matches the criteria for an…
The correct answer is C. %SEC-6-IPACCESSLOGP. Within the CHFI v11 syllabus under Network Forensics and Log Analysis, understanding Cisco router log mnemonics is essential for investigating network-based attacks and policy violations. Cisco devices generate structured log messages that include a facility, severity level…
Question
Sophia, a network security analyst, is reviewing the logs from a Cisco router in an attempt to identify suspicious traffic patterns. She encounters a log entry that matches the criteria for an access control list (ACL) filter, showing that a TCP or UDP packet was detected based on the applied rules. Based on the log entry description, which of the following is the correct mnemonic for this log message?
Options
- A%IPV6-6-ACCESSLOGP
- B%SEC-6-IPACCESSLOGRL
- C%SEC-6-IPACCESSLOGP
- D%SEC-4-TOOMANY
How the community answered
(48 responses)- A4% (2)
- B10% (5)
- C81% (39)
- D4% (2)
Explanation
Within the CHFI v11 syllabus under Network Forensics and Log Analysis, understanding Cisco router log mnemonics is essential for investigating network-based attacks and policy violations. Cisco devices generate structured log messages that include a facility, severity level, and mnemonic, which together describe the event detected by the device. The mnemonic %SEC-6-IPACCESSLOGP specifically indicates that a packet (TCP or UDP) matched an IP Access Control List (ACL) rule and was logged accordingly. The "SEC" facility denotes a security-related event, the severity level "6" represents an informational message, and "IPACCESSLOGP" confirms that the log entry was generated due to an ACL permit or deny rule matching a packet. This type of log is commonly used in forensic investigations to trace suspicious traffic, identify unauthorized access attempts, and correlate firewall or router behavior with other network logs.
Topics
Community Discussion
No community discussion yet for this question.