NSE4 · Question #461
Which answer best describes what an "Unknown Application" is?
The correct answer is C. Any traffic that does not match an application control signature. An "Unknown Application" in FortiGate Application Control refers to network traffic that does not match any recognized application signature in the FortiGate's database.
Question
Which answer best describes what an "Unknown Application" is?
Options
- AAll traffic that matches the internal signature for unknown applications.
- BTraffic that does not match the RFC pattern for its protocol.
- CAny traffic that does not match an application control signature
- DA packet that fails the CRC check.
How the community answered
(42 responses)- B2% (1)
- C95% (40)
- D2% (1)
Why each option
An "Unknown Application" in FortiGate Application Control refers to network traffic that does not match any recognized application signature in the FortiGate's database.
While it represents unidentified traffic, it's not about matching an 'internal signature for unknown applications'; rather, it's the absence of a match to a known application signature.
Traffic not matching an RFC pattern for its protocol might be malformed, but 'Unknown Application' specifically relates to the FortiGate's inability to identify a specific application, not protocol compliance.
''Unknown Application'' in the context of FortiGate Application Control specifically refers to network traffic that the FortiGate cannot identify against its extensive database of known application signatures. This category allows administrators to create policies for unidentified traffic, ensuring no traffic bypasses inspection or control.
A packet failing a CRC check indicates a physical or data link layer error, which is unrelated to application identification at the application layer.
Concept tested: FortiGate Application Control 'Unknown Application' definition
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/33941/application-control
Topics
Community Discussion
No community discussion yet for this question.