Which interface mode does an administrator use to generate the statdump file that can be converted into an SLR? Assume that the administrator wants to make the evaluation as unintrusive as possible

Question

Options

• AVirtual Wire
• BTAP
• CLayer 2
• DLayer 3

• A
  4% (1)
• B
  88% (22)
• D
  8% (2)

Explanation

TAP (Test Access Point) mode is correct because it operates passively - the firewall receives a mirror/copy of network traffic via a SPAN port or physical TAP device without sitting inline in the traffic path. This makes it the least intrusive option: production traffic flows uninterrupted, and the firewall can still analyze traffic patterns to generate the statdump file needed for an SLR (Security Lifecycle Review).

Why the distractors are wrong:

• Virtual Wire (A): Places the firewall inline between two interfaces, meaning it actively processes live traffic - more intrusive than TAP.
• Layer 2 (C): The firewall acts as a transparent bridge in the traffic path - still inline, still intrusive.
• Layer 3 (D): The firewall routes traffic as a next-hop device - fully inline and the most intrusive of all options.

Memory tip: Think "TAP = tap on the shoulder, not a roadblock." TAP mode listens to a copy of traffic without ever touching the original flow, just like physically tapping a wire. Any mode that requires recabling the network into the firewall (VWire, L2, L3) is inherently intrusive; TAP only needs a mirrored port.

No community discussion yet for this question.