Firewalls are an excellent source of:

Question

Options

• ADetails of system usage
• BDetails of protocol usage
• CForensic Evidence for malicious attacks
• DPort/service mappings

• A
  14% (4)
• B
  10% (3)
• C
  72% (21)
• D
  3% (1)

Explanation

Firewalls log all inbound and outbound traffic attempts - including blocked connections, source/destination IPs, timestamps, and rule matches - making them invaluable for reconstructing malicious activity after an incident, which is the definition of forensic evidence. Option A is wrong because firewalls track network traffic, not system-level activity like CPU usage, logins, or process execution (that's the job of OS audit logs or SIEMs). Option B is partially tempting since firewalls inspect protocol headers, but "details of protocol usage" describes tools like protocol analyzers or NetFlow collectors, not firewalls specifically. Option D is wrong because port/service mappings come from tools like nmap or a service registry - firewalls use port mappings to enforce rules, but don't produce them as output.

Memory tip: Think of a firewall as a security camera at the gate - it records who tried to get in, when, and whether they were let through. After a break-in, you review the footage (logs) = forensic evidence.

No community discussion yet for this question.