Exam N10-008 topic 1 question 708 discussion

Actual exam question from CompTIA's N10-008

Question #: 708
Topic #: 1

A firewall administrator observes log entries of traffic being allowed to a web server on port 80 and port 443. The policy for this server is to only allow traffic on port 443. The firewall administrator needs to investigate how this change occurred to prevent a reoccurrence. Which of the following should the firewall administrator do next?

A. Consult the firewall audit logs.
B. Change the policy to allow port 80.
C. Remove the server object from the firewall policy.
D. Check the network baseline.

Show Suggested Answer

Suggested Answer: A 🗳️

by subaie503 at March 16, 2024, 4:16 a.m.

Comments

Submit Cancel

subaie503

10 months, 3 weeks ago

Selected Answer: A

A. Consult the firewall audit logs. Consulting the firewall audit logs would be the most appropriate next step for the firewall administrator. These logs typically record all changes to firewall rules and policies, including who made the changes and when they were made. By reviewing the audit logs, the administrator can determine how the change allowing traffic on port 80 occurred and take steps to prevent a reoccurrence, such as tightening access controls or implementing stricter change management procedures.

upvoted 2 times

...