The most time-consuming part of firewall management is which?

• A. Creating ACLs
• B. Creating policies
• C. Reading firewall logs
• D. None of the above

Answer: (C)

Reading firewall logs is the most time-consuming part because logs generate a constant, high-volume stream of data from every connection attempt, allowed traffic, blocked traffic, and security alerts. Analyzing those logs requires sifting through immense detail to find meaningful events, distinguish legitimate activity from noise, and triage potential issues. This ongoing investigation is needed for troubleshooting, tuning rules to reduce false positives, and demonstrating compliance, often across multiple devices and timeframes. While creating ACLs and policies is essential, those tasks are typically upfront and less labor-intensive over time; the day-to-day workload grows with log review, correlation, and investigation, making log analysis the biggest time sink.