During a security incident, an analyst notices that certain malware traffic is using port 443 but is being identified as 'ssl'. The malware uses a unique handshake that differs from standard SSL. Which two actions should the analyst take to correctly identify and block this malware? (Choose two.)
Trap 1: Add the custom application to a security rule with action Deny.
Incorrect. Adding a custom application to a security rule with Deny requires the traffic to first be identified as that application. Without proper identification (via custom signature or override), the rule will not match.
Trap 2: Disable SSL decryption on the firewall.
Incorrect. Disabling SSL decryption does not help identify the malware; it may reduce visibility. App-ID can identify applications based on handshake patterns without decryption.
Trap 3: Create a decryption policy to forward proxy decrypt the traffic.
Incorrect. Decryption policy is for decrypting SSL traffic, not for identification. App-ID works on handshake characteristics even without decryption.
- A
Add the custom application to a security rule with action Deny.
Why wrong: Incorrect. Adding a custom application to a security rule with Deny requires the traffic to first be identified as that application. Without proper identification (via custom signature or override), the rule will not match.
- B
Disable SSL decryption on the firewall.
Why wrong: Incorrect. Disabling SSL decryption does not help identify the malware; it may reduce visibility. App-ID can identify applications based on handshake patterns without decryption.
- C
Create a custom application signature that matches the malware handshake.
Correct. A custom application signature matches the malware's unique handshake, allowing App-ID to correctly identify it despite using port 443.
- D
Create a decryption policy to forward proxy decrypt the traffic.
Why wrong: Incorrect. Decryption policy is for decrypting SSL traffic, not for identification. App-ID works on handshake characteristics even without decryption.
- E
Create an application override rule that forces identification as the custom application.
Correct. After creating the custom signature, an application override rule forces the firewall to apply that custom application identification to the traffic, enabling subsequent security rules to block it.