The security administrator has noticed a range of network problems affecting the proxy server. Based on reviewing the logs, the administrator notices that the firewall is being targeted with various…

Question

Options

• A
  1. Deploy an HTTP interceptor on the switch span port;
• B
  1. Deploy a protocol analyzer on the switch span port;
• C
  1. Deploy a protocol analyzer on the switch span port;
• D
  1. Deploy a network fuzzer on the switch span port;

• A
  18% (7)
• B
  10% (4)
• C
  69% (27)
• D
  3% (1)

Explanation

The correct answer is C. When a firewall is under active web-based attack and causing proxy/network issues, the most effective approach begins with deploying a protocol analyzer (e.g., Wireshark) on a switch SPAN (mirror) port to passively capture and inspect all traffic in detail. This provides deep visibility into attack patterns, payloads, and affected hosts without disrupting traffic. The subsequent steps in option C - which differ from B in the remediation phase - correctly follow up captured analysis with targeted rule tuning and patching. Option A (HTTP interceptor) only handles Layer 7 HTTP traffic and misses other attack vectors. Option D (network fuzzer) is an offensive/testing tool inappropriate for live incident response.

No community discussion yet for this question.