Exam 156-215.80 topic 1 question 209 discussion

Actual exam question from Checkpoint's 156-215.80

Question #: 209
Topic #: 1

Your boss wants you to closely monitor an employee suspected of transferring company secrets to the competition. The IT department discovered the suspect installed a WinSCP client in order to use encrypted communication. Which of the following methods is BEST to accomplish this task?

A. Use SmartView Tracker to follow his actions by filtering log entries that feature the WinSCP destination port. Then, export the corresponding entries to a separate log file for documentation.
B. Use SmartDashboard to add a rule in the firewall Rule Base that matches his IP address, and those of potential targets and suspicious protocols. Apply the alert action or customized messaging.
C. Watch his IP in SmartView Monitor by setting an alert action to any packet that matches your Rule Base and his IP address for inbound and outbound traffic.
D. Send the suspect an email with a keylogging Trojan attached, to get direct information about his wrongdoings.

Show Suggested Answer

Suggested Answer: A 🗳️

by mauchi at May 13, 2020, 7 p.m.

Comments

Submit Cancel

CCSAChallenger

8 months ago

Makes no sense to make exports, which are an action in time, which means you need to make multiple exports, when your objective is monitoring. I would do B in a real situation...

upvoted 1 times

...

ShabVj

1 year, 10 months ago

Why not C? If we specify only Port 22 as a filter the report will give us all WinSCP traffic of the network ( unrelated traffic ) , if we want to monitor the user specifically i would go with option C.

upvoted 1 times

...

kambata

2 years, 8 months ago

A, sounds logical.

upvoted 1 times

...