NGFW-ENGINEER · Question #61
In an enterprise network, security administrators want to control traffic based on application behavior rather than only using IP addresses and TCP/UDP ports. Which NGFW capability MOST directly enabl
The correct answer is C. Application Identification using Deep Packet Inspection. Traditional firewalls filter traffic using IP addresses and port numbers, but modern applications often share ports (e.g., many apps use TCP 443) or use dynamic ports, making port-based control insufficient. Application Identification using Deep Packet Inspection (DPI) is the def
Question
In an enterprise network, security administrators want to control traffic based on application behavior rather than only using IP addresses and TCP/UDP ports. Which NGFW capability MOST directly enables this requirement?
Options
- AStatic routing
- BNetwork Address Translation (NAT)
- CApplication Identification using Deep Packet Inspection
- DVLAN segmentation
How the community answered
(55 responses)- A5% (3)
- B2% (1)
- C91% (50)
- D2% (1)
Explanation
Traditional firewalls filter traffic using IP addresses and port numbers, but modern applications often share ports (e.g., many apps use TCP 443) or use dynamic ports, making port-based control insufficient. Application Identification using Deep Packet Inspection (DPI) is the defining NGFW capability that addresses this. DPI examines packet payloads beyond headers, analyzing protocol behavior, signatures, and patterns to identify the actual application regardless of port or encryption method. This allows policies like 'block BitTorrent' or 'allow Salesforce' based on what the application actually is, not just which port it uses. Static routing (A) handles path selection, NAT (B) translates addresses, and VLAN segmentation (D) isolates network segments - none of these identify application behavior.
Topics
Community Discussion
No community discussion yet for this question.