Which option describes a reason that a security administrator would configure suspect user agent scanning?

Question

Options

• Ato block Microsoft Updates
• Bto identify compromised hosts that are trying "phone home"
• Cto block corporate users from using nonsanctioned web browsers
• Dto protect web servers from attack

• A
  3% (1)
• C
  90% (26)
• D
  7% (2)

Explanation

Configuring suspect user agent scanning allows security administrators to inspect the User-Agent HTTP header in outbound requests, making it an effective tool for detecting and blocking employees who use non-approved browsers - browsers that may lack corporate security configurations, certificate pinning, or DLP controls enforced by the sanctioned browser fleet.

Why the distractors are wrong:

• A (Microsoft Updates): Windows Update traffic uses its own delivery mechanisms (BITS/WSUS), not HTTP user agents that suspect scanning would target.
• B (phone home): While malware does embed user agents, detecting C2 callbacks is typically handled by IDS/IPS or DNS filtering - not user agent scanning specifically.
• D (protect web servers from attack): Web application firewalls (WAFs) protect servers from inbound attacks; user agent scanning is an outbound/proxy-layer control focused on client behavior.

Memory tip: Think of "suspect user agents" as "the browser that doesn't belong here." The word suspect signals a policy violation - a user sneaking in an unauthorized tool - which maps directly to non-sanctioned browsers (C). If it were about malware or server protection, the question would say "malicious" rather than "suspect."

No community discussion yet for this question.