Security Heartbeat question

It should be all of them otherwise heartbeat is a failed security application.

ian

So the question aims at the Lateral Movement Prevention. Actually its more complex but easy to understand from a Firewall perspective.

So the Endpoint tries to isolate itself to prevent "everything". On top on that, the firewall will prevent the access to every other network. 

There is a feature called Lateral Movement Prevention. It will alert all other Endpoints about the heartbeat status of all client !Within the same network broadcast". So if you connect two networks like that with different routers, the firewall cannot alert the networks on A. The traffic von B to A is on the "core router", which completely cut the firewall. 

The firewall can protect C, because the traffic is protected as it flows through Firewall. 

You could argue: Even B is not protected. Simply because the packets never reach the Firewall as the router of B will fetch everything. So even lateral movement prevention from a firewall perspective is not involved in this scenario (Bad Design IMHO). 

Which is your answer? The question is: On which two of the networks can the endpoints be protected from the computer with a red health status?

-Mike

From which test this question is?  Can't remember such a question in XG training or test.
Mostly within training-guide you have exact these example/answer.
Unfortunately, there are often nonsensical questions in the exams that make sense in a different context in the student guide.

To the answer: I would say from the point of view of Entpoint Protection, this protection (Lateral Movement Prevention) is there to help devices that cannot be protected by a firewall because they are in the same network. So possibly A + B

ET80 - Sophos Firewall v18.5 - Engineer is the exam.

Do you have an answer for the question? I've already passed the exam, so I am not looking for someone to give me an answer so I pass.

I am curious as to why I was wrong (choosing A & C) and what and why is the correct answer so I understand.

-Mike

Its B + C (I am pretty sure). Simply because there is no technique in place to protect A. 

I contacted the Global Training team from Sophos and got the definitive answer.

As said by LuCar Toni, the correct answer is B and C. 

Passing through from A to B will not register the MAC at the firewall level to alert the endpoints in A of the infected endpoint. Whereas going from B to C does pass through the firewall so the traffic on C will be alerted. 

The person I spoke with acknowledged this question on the test could use more clarity and supporting information to make a decision and they will address that on future versions of the test.

Thank you all for your help on this question.

-Mike