Database operation records can be used as ___ evidence to backtrack security events.[fill in the blank]*

When configuring user single sign-on, the mode of receiving PC messages is adopted, and the authentication process has the following steps:
1. The visitor's PC executes the login script and sends the user login information to the AD monitor
2. The firewall extracts the corresponding relationship between the user and IP from the login information and adds it to the online user table
3. The AD monitor connects to the AD server to query login user information, and forwards the queried user information to the firewall
4. The visitor logs in to the AD domain, and the AD server returns a login success message to the user and delivers the login script. Which of the following is the correct order?

Which of the following is true about the difference between pre-incident prevention strategies and post-incident recovery strategies? (multiple choice)

The administrator PC is directly connected to the management port of the USG firewall and uses the web method to perform initialization operations. Which of the following statements is correct? (Multiple Choice)

Regarding the firewall security policy statement, which of the following options is wrong?