200-201 Question 113
Select 3A security analyst is tasked with monitoring network traffic for potential threats. However, the organization recently deployed encrypted communication protocols like TLS 1.3 and several cloud-based applications. How do these technologies impact the analyst's ability to gain data visibility?
- A
Encrypted protocols like TLS 1.3 reduce visibility into packet payloads, making it harder to inspect traffic for threats.
- B
Cloud-based applications can obscure network traffic since they do not always pass through traditional network monitoring tools.
- C
Encrypted protocols like TLS 1.3 increase data visibility by providing detailed metadata for threat analysis.
- D
Cloud-based applications improve visibility because they centralize logs and traffic in a single location.
- E
Both encrypted protocols and cloud-based applications necessitate additional tools or methods to regain full visibility.
Show answer and explanation
Correct answers: A, B, E
Explanation
Encrypted protocols and cloud-based applications introduce challenges to data visibility. Encryption limits the ability to inspect packet contents, and cloud services can obscure traffic from traditional monitoring tools. Analysts must adopt specialized tools and methods, such as decryption solutions, cloud-specific monitoring tools, or endpoint detection and response systems, to regain visibility and effectively monitor for threats.
- A. Correct.
Encrypted protocols like TLS 1.3 encrypt packet payloads, preventing traditional monitoring tools from performing deep packet inspection, thus reducing visibility.
- B. Correct.
Cloud-based applications often involve traffic bypassing traditional on-premises monitoring tools, making it more challenging to observe all activity.
- C. Incorrect.
TLS 1.3 does not inherently improve visibility; its primary function is to secure communications, not to enhance monitoring capabilities.
- D. Incorrect.
While cloud-based applications can offer centralized logging, they do not automatically improve visibility, especially when using multiple cloud services.
- E. Correct.
To overcome the challenges of encrypted traffic and cloud-based applications, additional tools like packet decryption solutions, cloud-native monitoring, or endpoint detection tools are required to regain visibility.