An administrator wants to verify in a firewall's traffic log that ICMP traffic between two remote hosts was successfully permitted through an established site-to-site VPN tunnel. Which combination of log fields confirms that the traffic was processed by the intended security policy?

### Why this is right The lab asks students to open the completed W1-to-W1 ping session and confirm its source and destination IP addresses, ping application, Allow action, and matching VPN policy. These details show that the expected hosts communicated and the intended rule permitted the session. ### The concept A traffic log records information about a session and the firewall's handling of it. The matching rule is evidence that the VPN security policy, rather than an unrelated rule, allowed the traffic. The task also requires the key to remain masked in screenshots, so exposing it is inappropriate. ### The other options - **B. Only the firewall's Internet interface address and a source NAT rule**: Those relate to the WAN prerequisite test, not the completed internal VPN session. - **C. The pre-shared key in readable form and the workstation's password**: The key must remain masked, and the task does not request a workstation password. - **D. Only the tunnel interface name, without session or policy details**: The required evidence includes session endpoints, application, action, and matching rule. ### Terms - **W1**: The workstation named condorID-W1 in the lab. - **IP**: Internet Protocol. Provides network addressing. - **VPN**: Virtual Private Network. Connects private networks through a protected path. ### Remember A useful traffic-log check identifies endpoints, application, action, and matched rule.