Logging or Tracing JN0-637 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security administrator is managing a device that generates a large volume of session logs. The administrator needs to ensure that logs are retained for at least 30 days for compliance, but disk space is limited. Which configuration approach best balances log retention and disk space usage?

   • AIncrease the log file size to accommodate 30 days of logs.
   • BDisable log rotation to preserve all logs.
   • CConfigure a log file rotation size and a number of files to keep that covers 30 days of logs.
   • DConfigure the log file to overwrite when full.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security administrator notices that the security policy logs only show sessions that were explicitly denied by a policy, but not sessions that were permitted. The administrator needs to verify that legitimate traffic is matching the intended permit policies. Which configuration change will accomplish this?

   • AEnable the traceoptions statement on the security policy.
   • BAdd the log-initial and log-close statements to the permit policies.
   • CConfigure the log statement under the security policy with the session-log parameter set to deny.
   • DAdd the syslog statement to the security zone configuration.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of interpreting trace output for security policies?

   • ATo determine the amount of traffic passing through the firewall.
   • BTo generate reports for management.
   • CTo diagnose complex issues by examining detailed internal operations of the policy engine.
   • DTo configure new security policies.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which log field is most useful for identifying which security policy matched a denied session?

   • ASource IP address
   • BInterface name
   • CDestination port
   • DPolicy name
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A network engineer is troubleshooting an intermittent issue where traffic from a specific subnet is being dropped by the security policy engine. The engineer needs to capture detailed trace information about the policy lookup process for this traffic. Which configuration should be applied?

   • AEnable session logging on the security policy and review the logs.
   • BConfigure traceoptions under the security policy with a flag for policy matching and a file with a size limit.
   • CConfigure a firewall filter to count packets from the subnet.
   • DUse the monitor traffic interface command to capture packets.
   Reveal Solution Discussion Select an answer first