<< Prev Question Next Question >>

Question 83/100

An administrator creates an SSL decryption rule decrypting traffic on all ports. The administrator also creates a Security policy rule allowing only the applications DNS, SSL, and web-browsing.
The administrator generates three encrypted BitTorrent connections and checks the Traffic logs. There are three entries. The first entry shows traffic dropped as application Unknown. The next two entries show traffic allowed as application SSL.
Which action will stop the second and subsequent encrypted BitTorrent connections from being allowed as SSL?

A. Disable the exclude cache option for the firewall.

B. Create a Security policy rule that matches application "encrypted BitTorrent" and place the rule at the top of the Security policy.

C. Create a Decryption Profile to block traffic using unsupported cyphers, and attach the profile to the decryption rule.

D. Create a decryption rule matching the encrypted BitTorrent traffic with action "No-Decrypt," and place the rule at the top of the Decryption policy.

Recent Comments (The most recent comments are at the top.)

Andy - Jul 02, 2018

B is the correct answer. The scenario mentions nothing about unsupported ciphers. Even so, if that were the case then the firewall would not report the application as Unknown in the beginning. Once the packet is decrypted, the firewall must identify the application over SSL, therefore allowing the firewall to block BitTorrent.

Question 83/100

Recent Comments (The most recent comments are at the top.)

LEAVE A REPLY

Download PDF File