The Falcon sensor uses certificate pinning to defend against man-in-the-middle attacks. Which statement is TRUE concerning Falcon sensor certificate validation?

Question

Options

• ASSL inspection should be configured to occur on all Falcon traffic
• BSome network configurations, such as deep packet inspection, interfere with certificate validation
• CHTTPS interception should be enabled to proceed with certificate validation
• DCommon sources of interference with certificate pinning include protocol race conditions and

• A
  4% (2)
• B
  88% (42)
• C
  6% (3)
• D
  2% (1)

Explanation

The statement that some network configurations, such as deep packet inspection, interfere with certificate validation is true concerning Falcon sensor certificate validation. The Falcon sensor uses certificate pinning to defend against man-in-the-middle attacks, which means that it verifies that the server certificate presented by the Falcon cloud matches a hard-coded certificate embedded in the sensor. Some network configurations, such as deep packet inspection, SSL inspection, or HTTPS interception, may attempt to modify or replace the server certificate, which will cause the sensor to reject the connection and generate an error.

No community discussion yet for this question.