Which TWO methods can be used to identify traffic using App-ID when port-based rules are insufficient?
Behavioural analysis inspects flow characteristics — packet timing, session patterns, payload statistics — to infer the application even when it evades static signatures or uses non-standard ports. This satisfies the stem's need to identify traffic when port-based rules alone are insufficient.
Why this answer
Option A is correct because App-ID can identify applications through behavioral analysis, observing session characteristics such as packet timing, payload sizes, and flow patterns to distinguish applications that cannot be reliably separated by port alone. Option C is correct because App-ID relies on Deep Packet Inspection (DPI) signatures that match application-specific protocol patterns and payload content, which is exactly how it identifies traffic when port-based rules are insufficient. Options B, D, and E do not belong: IP address reputation filtering and MAC address filtering identify hosts or devices rather than applications, and URL filtering categories classify web destinations rather than the application generating the traffic.