On an SRX Series firewall, what are two ways that Encrypted Traffic Insights assess the threat of the traffic? (Choose two.)

Question

Options

• AIt decrypts the file in a sandbox.
• BIt validates the certificates used.
• CIt decrypts the data to validate the hash.
• DIt reviews the timing and frequency of the connections.

• A
  3% (1)
• B
  91% (30)
• C
  6% (2)

Explanation

Encrypted Traffic Insights is a feature that enables the SRX Series firewall and the ATP Cloud to detect malicious threats that are hidden in encrypted traffic without decrypting the traffic. It does so by analyzing the metadata and connection patterns of the encrypted sessions. Two ways that Encrypted Traffic Insights assess the threat of the traffic are: It validates the certificates used: The SRX Series firewall extracts the server certificate from the encrypted session and compares its signature with a blocklist of known malicious certificates provided by ATP Cloud. If there is a match, the session is blocked and reported as a threat. It reviews the timing and frequency of the connections: The SRX Series firewall sends the connection details, such as source and destination IP addresses, ports, protocols, and timestamps, to ATP Cloud. ATP Cloud applies behavior analysis and machine learning algorithms to detect anomalous or suspicious patterns of connections, such as high frequency, low duration, or unusual timing. Reference: = Juniper Networks Expands Connected Security Portfolio with Encrypted Traffic Analysis for Juniper Advanced Threat Prevention and SecIntel for Mist Wireless, Encrypted Traffic Insights Overview, Configure Encrypted Traffic Insights

No community discussion yet for this question.