Which of the following descriptions about ASPF and Server-Map is correct?

Question

Options

• AAfter the message hits the Server-map table, it needs to be controlled by the security policy
• BWhen the Server-Map table fails to match, it will check whether it is denied by the server-map table
• CThe session table is a concrete reflection of the connection status of the two parties in the communication
• DThe Server-map table is generated by the firewall based on the session table

• A
  12% (4)
• B
  3% (1)
• C
  6% (2)
• D
  79% (26)

Explanation

Option D is correct because ASPF (Application Specific Packet Filter) works by inspecting application-layer data within active sessions, then dynamically generating Server-Map entries to pre-authorize anticipated secondary connections (e.g., FTP data channels). The Server-Map table is a product of ASPF analyzing existing session traffic - it exists because of sessions, not independently of them.

Why the distractors are wrong:

• A is wrong: Traffic matching the Server-Map table bypasses the security policy - that's the entire purpose of Server-Map. It pre-authorizes expected connections so they don't need a full policy lookup.
• B is wrong: When a packet fails to match the Server-Map, the firewall moves on to check the security policy for new session creation - it does not re-check the Server-Map for a denial decision (that would be circular).
• C is wrong: The statement describes the session table accurately on its face, but it belongs to the session table's role, not Server-Map's. In the ASPF/Server-Map context, the Server-Map tracks anticipated future connections, while the session table tracks established connection states.

Memory tip: Think of it as a pipeline - ASPF watches sessions → writes Server-Map entries → those entries wave through related traffic without a policy re-check. Server-Map is always downstream of session inspection, so it must be generated from sessions (D).

No community discussion yet for this question.