NSE4 · Question #218
Which of the following statements are correct regarding Application Control?
The correct answer is A. Application Control is based on the IPS engine. C. Application Control can be applied to SSL encrypted traffic. Application Control utilizes the IPS engine for application identification and can inspect SSL encrypted traffic when SSL inspection is enabled on the FortiGate.
Question
Which of the following statements are correct regarding Application Control?
Options
- AApplication Control is based on the IPS engine.
- BApplication Control is based on the AV engine.
- CApplication Control can be applied to SSL encrypted traffic.
- DApplication Control cannot be applied to SSL encrypted traffic.
How the community answered
(22 responses)- A91% (20)
- B5% (1)
- D5% (1)
Why each option
Application Control utilizes the IPS engine for application identification and can inspect SSL encrypted traffic when SSL inspection is enabled on the FortiGate.
FortiGate's Application Control feature leverages the same deep packet inspection (DPI) engine used by the Intrusion Prevention System (IPS) to identify and classify applications based on their unique signatures and behavioral patterns.
Application Control is distinct from the Antivirus (AV) engine; while both are security services, they serve different purposes-AV for malware detection, Application Control for traffic classification and policy enforcement.
Application Control can be effectively applied to SSL encrypted traffic, provided that SSL inspection (deep inspection or certificate inspection) is enabled, allowing the FortiGate to decrypt, inspect, and re-encrypt the traffic.
This statement contradicts the capability of FortiGate with SSL inspection; Application Control can indeed be applied to SSL encrypted traffic when decryption is performed.
Concept tested: Application Control engine and SSL inspection
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/523930/application-control
Topics
Community Discussion
No community discussion yet for this question.