PCNSE · Question #623
PCNSE Question #623: Real Exam Question with Answer & Explanation
The correct answer is A: While troubleshooting. Session-start logging creates a log entry the moment a session opens, then another when it closes, effectively doubling log volume and storage load. This overhead is only justified during active troubleshooting - for example, when you need to confirm that a long-lived session was
Question
As a best practice, logging at session start should be used in which case?
Options
- AWhile troubleshooting
- BOnly on Deny rules
- COnly when log at session end is enabled
- DOn all Allow rules
Explanation
Session-start logging creates a log entry the moment a session opens, then another when it closes, effectively doubling log volume and storage load. This overhead is only justified during active troubleshooting - for example, when you need to confirm that a long-lived session was seen before it terminates. Best practice is to leave session-start logging disabled in production and enable it only while diagnosing a specific issue.
Topics
Community Discussion
No community discussion yet for this question.