Referring to the flow logs exhibit, which two statements are correct? (Choose two.)

Question

Options

• AThe packet is dropped by the default security policy.
• BThe packet is dropped by a configured security policy.
• CThe data shown requires a traceoptions flag of host-traffic.
• DThe data shown requires a traceoptions flag of basic-datapath.

• A
  69% (27)
• B
  10% (4)
• C
  21% (8)

Explanation

Understanding the Flow Log Output: From the flow logs in the exhibit, we can observe the following key events: The session creation was initiated (flow_first_create_session), but the policy search failed (flow_first_policy_search), which implies that no matching policy was found between the zones involved (zone trust-> zone dmz). The packet was dropped with the reason "denied by policy." This shows that the packet was dropped either due to no matching security policy or because the default policy denies the traffic (packet dropped, denied by policy). The line denied by policy default-policy-logical-system-00(2) indicates that the default security policy is responsible for denying the traffic, confirming that no explicit security policy was configured to allow this traffic.

No community discussion yet for this question.