A firewall engineer is tasked with defining signatures for a custom application. Which two sources can the engineer use to gather information about the application patterns? (Choose two.)

The correct answer is A. Traffic logs D. Wireshark. Traffic Logs: These logs provide detailed records of network traffic, including source and destination IP addresses, port numbers, protocols used, and the actions taken by the firewall (e.g., allow, drop, or reject). By analyzing traffic logs, the engineer can identify patterns…

Submitted by olafpl· Apr 18, 2026Deploy and Configure

Question

Options

ATraffic logs
BData filtering logs
CPolicy Optimizer
DWireshark

How the community answered

(43 responses)

A
93% (40)
B
5% (2)
C
2% (1)

Explanation

Traffic Logs: These logs provide detailed records of network traffic, including source and destination IP addresses, port numbers, protocols used, and the actions taken by the firewall (e.g., allow, drop, or reject). By analyzing traffic logs, the engineer can identify patterns and behaviors specific to the custom application, aiding in signature creation. Wireshark: This network protocol analyzer captures and displays packets in real-time, allowing the engineer to inspect the application's data exchanges at a granular level. Wireshark's detailed packet analysis can reveal unique characteristics and behaviors of the custom application, which are essential for crafting accurate signatures.

Topics

#Custom Application Signatures#Traffic Analysis#Packet Capture#Logging

Community Discussion

No community discussion yet for this question.

Full PCNSE Practice