A root cause analysis investigation into a recent security incident reveals that several decryption rules have been disabled. The security team wants to generate email alerts when decryption rules are changed. How should email log forwarding be configured to achieve this goal?

Question

Accepted Answer

B. With the relevant configuration log filter inside Device > Log Settings Changes to security policies, including decryption rules, are recorded as configuration logs, and the filters for these logs are applied in Device > Log Settings to trigger email alerts via a configured log forwarding profile.

Answer

A. With the relevant system log filter inside Device > Log Settings System logs record operational events of the firewall, not changes to security policy configurations like decryption rules.

Answer

C. With the relevant configuration log filter inside Objects > Log Forwarding While Objects > Log Forwarding defines the log forwarding profiles, the specific log type filters (like for configuration logs) are defined under Device > Log Settings.

Answer

D. With the relevant system log filter inside Objects > Log Forwarding System logs do not capture configuration changes, and the specific log filtering definition is done under Device > Log Settings, not directly in Objects > Log Forwarding.

A root cause analysis investigation into a recent security incident reveals that several decryption rules have been disabled. The security team wants to generate email alerts when decryption rules…

Question

Options

How the community answered

Why each option

Topics

Community Discussion