If a firewall receives a provable attack packet, the firewall will ________.

• A. Log the packet
• B. Drop the packet
• C. Both log and drop
• D. Ignore the packet

Answer: (C)

When a firewall can prove an attack packet, you want to both stop it and record it. Dropping the packet prevents the malicious traffic from reaching its target, protecting the network from harm. At the same time, logging the event captures details like the source, destination, timestamp, and which rule triggered the block, providing valuable evidence for incident response, anomaly detection, and compliance. Together, these actions deliver immediate defense and long-term visibility, which is why logging and dropping is the best approach. Logging alone would not stop the threat, dropping without logging would lose useful audit data, and ignoring the packet would leave the system unprotected.