nerdexam
CrowdStrike

CCFA-200B · Question #42

The Falcon sensor uses certificate pinning to defend against man-in-the-middle attacks. Which statement is TRUE concerning Falcon sensor certificate validation?

The correct answer is B. Some network configurations, such as deep packet inspection, interfere with certificate validation. The statement that some network configurations, such as deep packet inspection, interfere with certificate validation is true concerning Falcon sensor certificate validation. The Falcon sensor uses certificate pinning to defend against man-in-the-middle attacks, which means that

Sensor Deployment and Network Configuration

Question

The Falcon sensor uses certificate pinning to defend against man-in-the-middle attacks. Which statement is TRUE concerning Falcon sensor certificate validation?

Options

  • ASSL inspection should be configured to occur on all Falcon traffic
  • BSome network configurations, such as deep packet inspection, interfere with certificate validation
  • CHTTPS interception should be enabled to proceed with certificate validation
  • DCommon sources of interference with certificate pinning include protocol race conditions and

How the community answered

(48 responses)
  • A
    4% (2)
  • B
    88% (42)
  • C
    6% (3)
  • D
    2% (1)

Explanation

The statement that some network configurations, such as deep packet inspection, interfere with certificate validation is true concerning Falcon sensor certificate validation. The Falcon sensor uses certificate pinning to defend against man-in-the-middle attacks, which means that it verifies that the server certificate presented by the Falcon cloud matches a hard-coded certificate embedded in the sensor. Some network configurations, such as deep packet inspection, SSL inspection, or HTTPS interception, may attempt to modify or replace the server certificate, which will cause the sensor to reject the connection and generate an error.

Topics

#certificate pinning#SSL inspection#deep packet inspection#network configuration

Community Discussion

No community discussion yet for this question.

Full CCFA-200B Practice