A company deploys an NGFW and notices that several applications running over HTTPS (TCP 443) cannot be accurately identified. What is the MOST likely reason for this behavior?

The correct answer is B. SSL/TLS decryption is not enabled. HTTPS wraps HTTP traffic in TLS/SSL encryption. When SSL/TLS decryption is not enabled, the NGFW can only see the outer TLS handshake metadata (such as the SNI hostname) but cannot inspect the encrypted payload. This means the firewall cannot perform deep packet inspection on the

Application Identification and Traffic Visibility

Question

A company deploys an NGFW and notices that several applications running over HTTPS (TCP 443) cannot be accurately identified. What is the MOST likely reason for this behavior?

Options

AThe firewall does not support application control
BSSL/TLS decryption is not enabled
CNAT is misconfigured
DThe routing table is incomplete

How the community answered

(53 responses)

A
2% (1)
B
94% (50)
C
4% (2)

Explanation

HTTPS wraps HTTP traffic in TLS/SSL encryption. When SSL/TLS decryption is not enabled, the NGFW can only see the outer TLS handshake metadata (such as the SNI hostname) but cannot inspect the encrypted payload. This means the firewall cannot perform deep packet inspection on the actual application data, making it impossible to accurately identify many applications that tunnel over HTTPS. Enabling SSL/TLS inspection (also called SSL decryption or SSL forward proxy) allows the NGFW to decrypt, inspect, and re-encrypt traffic in real time. A missing application control feature (A) would affect all application identification, not just HTTPS. NAT misconfiguration (C) would cause connectivity failures, not misidentification. An incomplete routing table (D) would prevent traffic from being forwarded, not misidentified.

Topics

#NGFW#Application Identification#SSL/TLS Decryption#HTTPS

Community Discussion

No community discussion yet for this question.

Full NGFW-ENGINEER Practice