A security team wants to block peer-to-peer file sharing applications even when those applications attempt to evade detection by using non-standard ports. Which NGFW capability enables this control?

The correct answer is B. Application signature and behavior analysis. P2P applications like BitTorrent are specifically designed to evade port-based blocking by dynamically changing ports, using well-known ports (like 80 or 443), or mimicking other protocols. Port-based ACLs (A and C) are completely ineffective against this evasion technique. Appli

Application Identification and Control

Question

Options

APort-based access control
BApplication signature and behavior analysis
CStatic access control lists
DQoS traffic shaping

How the community answered

(58 responses)

A
2% (1)
B
90% (52)
C
5% (3)
D
3% (2)

Explanation

P2P applications like BitTorrent are specifically designed to evade port-based blocking by dynamically changing ports, using well-known ports (like 80 or 443), or mimicking other protocols. Port-based ACLs (A and C) are completely ineffective against this evasion technique. Application signature and behavior analysis examines the actual payload patterns, handshake sequences, protocol structures, and behavioral characteristics of traffic regardless of the port being used. By recognizing the unique fingerprint of P2P protocol behavior, the NGFW can identify and block the application even on port 443 or any other port. QoS traffic shaping (D) can throttle bandwidth but cannot reliably identify and block evasive applications the way behavioral analysis can.

Topics

#Application Identification#NGFW Capabilities#Traffic Classification#Deep Packet Inspection

Community Discussion

No community discussion yet for this question.

Full NGFW-ENGINEER Practice