Which of the following MOST interferes with network-based detection techniques?

The correct answer is B. SSL. SSL/TLS encrypts traffic between a client and server, meaning network-based intrusion detection systems (NIDS) and deep packet inspection tools cannot read the payload content of the traffic. Because the data is ciphertext, signature-based and anomaly-based network detection…

Security operations

Question

Options

AMime-encoding
BSSL
CFTP
DAnonymous email accounts

How the community answered

(39 responses)

A
5% (2)
B
74% (29)
C
13% (5)
D
8% (3)

Explanation

SSL/TLS encrypts traffic between a client and server, meaning network-based intrusion detection systems (NIDS) and deep packet inspection tools cannot read the payload content of the traffic. Because the data is ciphertext, signature-based and anomaly-based network detection that relies on inspecting packet contents is effectively blind to threats hidden inside SSL-encrypted sessions. MIME encoding (A) encodes data but doesn't encrypt it - it can still be decoded and inspected. FTP (C) is a plaintext protocol, fully visible to network monitors. Anonymous email accounts (D) affect attribution, not the detectability of network traffic content.

Topics

#SSL/TLS#encrypted traffic#IDS evasion#network monitoring

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice