350-201 Question 114
Single answerAn organization has deployed Cisco Secure Firewall and is using application filtering to control access to specific applications. The security team notices that certain unauthorized applications are still being accessed, bypassing the configured rules. What is the most likely cause of this issue?
- A
The application signature database is outdated.
- B
The firewall is improperly applying NAT rules.
- C
The security policy is configured to block only known malware.
- D
The traffic is encrypted and the firewall is not performing SSL decryption.
Show answer and explanation
Correct answer: D
Explanation
Application filtering relies on identifying application-layer traffic. If the traffic is encrypted and SSL decryption is not enabled, the firewall cannot inspect the payload and identify or block specific applications. Ensuring SSL decryption is properly configured is critical to enforcing application filtering policies effectively.
- A. Incorrect.
An outdated application signature database can cause issues identifying applications, but it is not the most likely cause if encrypted traffic is bypassing inspection.
- B. Incorrect.
Improper NAT rules may cause routing or connectivity issues but are not directly related to unauthorized application access.
- C. Incorrect.
Blocking only known malware in security policies is unrelated to application filtering, which is designed to control application-specific traffic.
- D. Correct.
Encrypted traffic prevents the firewall from inspecting application-level data unless SSL decryption is enabled. This is the most likely cause of unauthorized applications bypassing filtering.