A malicious user is attempting to connect to a blocked website by crafting a packet using a fake SNI and the correct website in the HTTP host header. Which option will prevent this form of attack?

Question

Options

• AAdvanced Threat Prevention option to block "Domain Fronting"
• BAdvanced URL Filtering and block the "Malicious Behavior" category
• CAdvanced URL Filtering and block "SNI mismatch with Server Certificate (SAN/CN)"
• DSSL Decryption to "Block sessions on SNI mismatch with Server Certificate (SAN/CN)"

• A
  25% (9)
• B
  11% (4)
• C
  6% (2)
• D
  58% (21)

Explanation

This option ensures that SSL Decryption checks for mismatches between the Server Name Indication (SNI) field in the TLS handshake and the Common Name (CN) or Subject Alternative Name (SAN) in the server certificate. If a malicious user tries to bypass content filtering by spoofing the SNI while using the real blocked website in the HTTP host header, this setting will detect the discrepancy and block the session, preventing unauthorized access.

No community discussion yet for this question.