Which interface mode do you use to generate the statdump file that can be converted into an SLR? Assume that the SE wants to make the evaluation as unintrusive as possible.

Question

Options

• AVirtual Wire
• BLayer 2
• CTAP
• DLayer 3

• B
  5% (1)
• C
  91% (20)
• D
  5% (1)

Explanation

TAP (Test Access Point) mode is correct because it operates as a passive listener - the firewall receives a mirrored copy of traffic (via a SPAN port or network tap) without sitting inline, meaning it never touches or disrupts production traffic. This makes it the most unintrusive way to capture the traffic statistics needed to generate a statdump, which is then converted into a Security Lifecycle Review (SLR).

Why the distractors are wrong:

• Virtual Wire (A) places the firewall transparently inline at Layer 1/2 - traffic physically passes through it, which is more intrusive and introduces a potential point of failure.
• Layer 2 (B) makes the firewall act as a bridge/switch inline - again, traffic flows through the device, not just past it.
• Layer 3 (D) is full routing mode where the firewall is a live gateway - the most intrusive option, as it actively routes and can alter/drop traffic.

Memory tip: Think of TAP as "just tapping on the glass" - you're watching traffic without ever touching it. If the SE needs a non-disruptive evaluation (like a pre-sales proof of concept), TAP = zero risk to the production environment.

No community discussion yet for this question.