Security Heartbeat question

Question

On which two of the networks can the endpoints be protected from the computer with a red health status? Why do you answer that way? 
 I feel like it's a trick question as wouldn't all three be protected? I said A and C since B was obvious. I was wrong. I don't know why I was wrong though. 
 -Mike

LuCar Toni · Accepted Answer

So the question aims at the Lateral Movement Prevention. Actually its more complex but easy to understand from a Firewall perspective. 
 So the Endpoint tries to isolate itself to prevent "everything". On top on that, the firewall will prevent the access to every other network. 
 There is a feature called Lateral Movement Prevention. It will alert all other Endpoints about the heartbeat status of all client !Within the same network broadcast". So if you connect two networks like that with different routers, the firewall cannot alert the networks on A. The traffic von B to A is on the "core router", which completely cut the firewall. 
 The firewall can protect C, because the traffic is protected as it flows through Firewall. 
 You could argue: Even B is not protected. Simply because the packets never reach the Firewall as the router of B will fetch everything. So even lateral movement prevention from a firewall perspective is not involved in this scenario (Bad Design IMHO).

MJ_P1 · Answer

I contacted the Global Training team from Sophos and got the definitive answer. 
 As said by LuCar Toni , the correct answer is B and C. 
 Passing through from A to B will not register the MAC at the firewall level to alert the endpoints in A of the infected endpoint. Whereas going from B to C does pass through the firewall so the traffic on C will be alerted. 
 The person I spoke with acknowledged this question on the test could use more clarity and supporting information to make a decision and they will address that on future versions of the test. 
 Thank you all for your help on this question. 
 -Mike

Security Heartbeat question

Top Replies