Which three mechanisms are valid for enabling user mapping? (Choose three.)

Question

Options

• ACaptive Portal
• BDomain server monitoring
• CReverse DNS lookup
• DUser behaviour recognition
• EClient probing

• A
  83% (29)
• C
  11% (4)
• D
  6% (2)

Explanation

Captive Portal (A), Domain server monitoring (B), and Client probing (E) are all recognized methods that actively map an IP address to an authenticated username. Captive Portal redirects unauthenticated users to a login page, forcing explicit credential entry. Domain server monitoring (such as listening to Windows Security Event logs on a domain controller) captures login events as they happen and records which user authenticated from which IP. Client probing queries individual workstations directly - for example, via WMI - to discover who is currently logged in.

Reverse DNS lookup (C) resolves an IP address to a hostname, not to a username, so it identifies machines, not people. User behaviour recognition (D) is a concept associated with threat detection and analytics, not a defined mechanism for assigning user identity to an IP address in a policy enforcement context.

Memory tip: Think of the three correct answers as "catch them at the door, watch the server, or ask the machine." Captive Portal catches users at the network entry point, domain server monitoring watches authentication events at the server, and client probing asks the endpoint directly.

No community discussion yet for this question.