200-201 Question 234
Select 4A cybersecurity analyst at your organization notices unusual traffic patterns originating from a specific internal workstation. Upon further investigation, the analyst discovers that a file-sharing application not approved by the organization has been installed on the machine. To mitigate this, the analyst suggests implementing network application control. Which of the following actions would effectively control unauthorized applications on the network?
- A
Configure the firewall to allow only approved application traffic based on application signatures.
- B
Use a web proxy to block access to known URLs associated with the unauthorized application.
- C
Enable deep packet inspection (DPI) to identify and block traffic from unapproved applications.
- D
Rely solely on IP-based access control lists (ACLs) to block traffic from the workstation.
- E
Implement endpoint security software to prevent installation of unauthorized applications.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
Network application control involves a combination of techniques to identify, monitor, and restrict applications based on their behavior or signatures. Using firewalls, web proxies, and DPI provides comprehensive network-level control, while endpoint security ensures that unauthorized applications cannot be installed or executed at the device level. Solely relying on IP-based ACLs is insufficient as they lack application-level awareness, making it an inadequate solution for this scenario.
- A. Correct.
This is a valid option because modern firewalls can identify and allow/block traffic based on application signatures, enabling precise control over network applications.
- B. Correct.
Using a web proxy to block access to specific URLs associated with the unauthorized application can effectively prevent the application from functioning.
- C. Correct.
Deep packet inspection (DPI) is a critical tool for analyzing application-layer data and can be used to detect and block unauthorized applications on the network.
- D. Incorrect.
Relying solely on IP-based ACLs is not effective for application control since they cannot differentiate between approved and unapproved applications based on content or behavior.
- E. Correct.
Endpoint security software can prevent unauthorized applications from being installed or executed, complementing network-based controls.