PCNSE · Question #12
A critical US-CERT notification is published regarding a newly discovered botnet. The malware is very evasive and is not reliably detected by endpoint antivirus software. Furthermore, SSL is used to…
The correct answer is A. Anti-Spyware profiles applied outbound security policies with DNS Query action set to sinkhole. Even when SSL decryption is not enabled, infected hosts must resolve the C&C server's domain name via DNS before establishing the SSL tunnel. DNS queries are typically unencrypted. Anti-Spyware profiles with the DNS Sinkhole action (A) intercept DNS queries for known malicious…
Question
A critical US-CERT notification is published regarding a newly discovered botnet. The malware is very evasive and is not reliably detected by endpoint antivirus software. Furthermore, SSL is used to tunnel malicious traffic to command-and-control servers on the internet and SSL Forward Proxy Decryption is not enabled. Which component once enabled on a perimeter firewall will allow the identification of existing infected hosts in an environment?
Options
- AAnti-Spyware profiles applied outbound security policies with DNS Query action set to sinkhole
- BFile Blocking profiles applied to outbound security policies with action set to alert
- CVulnerability Protection profiles applied to outbound security policies with action set to block
- DAntivirus profiles applied to outbound security policies with action set to alert
How the community answered
(30 responses)- A80% (24)
- B7% (2)
- C3% (1)
- D10% (3)
Explanation
Even when SSL decryption is not enabled, infected hosts must resolve the C&C server's domain name via DNS before establishing the SSL tunnel. DNS queries are typically unencrypted. Anti-Spyware profiles with the DNS Sinkhole action (A) intercept DNS queries for known malicious domains and return a fake sinkhole IP address. When an infected host then attempts to connect to the sinkhole IP, the firewall logs that connection, positively identifying the infected internal host - without needing to decrypt the SSL session. This makes DNS Sinkhole uniquely effective in this scenario. File Blocking profiles (B) require inspectable content. Vulnerability Protection profiles (C) protect against exploits, not C&C identification. Antivirus profiles (D) scan file payloads and cannot inspect encrypted SSL traffic without decryption.
Topics
Community Discussion
No community discussion yet for this question.