ExamGecko
Question list
Search
Search

Related questions











Question 276 - PCNSE discussion

Report
Export

As a best practice, logging at session start should be used in which case?

A.
On all Allow rules
Answers
A.
On all Allow rules
B.
While troubleshooting
Answers
B.
While troubleshooting
C.
Only when log at session end is enabled
Answers
C.
Only when log at session end is enabled
D.
Only on Deny rules
Answers
D.
Only on Deny rules
Suggested answer: B

Explanation:

Logging at session start should be used as a best practice while troubleshooting. Logging at session start allows the administrator to see the logs for sessions that are initiated but not completed, such as sessions that are dropped or blocked by the firewall. This can help the administrator to identify and resolve issues with network connectivity or firewall configuration. Logging at session start should not be used for normal operations because it generates more logs and consumes more resources on the firewall. Option A is incorrect because logging at session start should not be used on all Allow rules. Logging at session end is sufficient for Allow rules because it provides information about the completed sessions, such as bytes and packets transferred, application, user, and threat information.

Option C is incorrect because logging at session start can be used independently of logging at session end. Logging at session start and logging at session end are not mutually exclusive options. Option D is incorrect because logging at session start should not be used only on Deny rules. Logging at session end is sufficient for Deny rules because it provides information about the denied sessions, such as source and destination IP addresses, ports, and protocol.

asked 23/09/2024
Kevin Lizano
37 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first