ExamGecko
Question list
Search
Search

List of questions

Search

Related questions











Question 166 - SY0-601 discussion

Report
Export

Which of the following is required in order for an IDS and a WAF to be effective on HTTPS traffic?

A.
Hashing
Answers
A.
Hashing
B.
DNS sinkhole
Answers
B.
DNS sinkhole
C.
TLS inspection
Answers
C.
TLS inspection
D.
Data masking
Answers
D.
Data masking
Suggested answer: C

Explanation:

an IDS (Intrusion Detection System) and a WAF (Web Application Firewall) are both used to monitor and protect web applications from common attacks such as cross-site scripting and SQL injection12. However, these attacks can also be hidden in encrypted HTTPS traffic, which uses the TLS (Transport Layer Security) protocol to provide cryptography and authentication between two communicating applications34. Therefore, in order for an IDS and a WAF to be effective on HTTPS traffic, they need to be able to decrypt and inspect the data that flows in the TLS tunnel. This is achieved by using a feature called TLS inspection345, which creates two dedicated TLS connections:

one with the web server and another with the client. The firewall then uses a customer-provided CA (Certificate Authority) certificate to generate an on-the-fly certificate that replaces the web server certificate and shares it with the client. This way, the firewall can see the content of the HTTPS traffic and apply the IDS and WAF rules accordingly34.

asked 02/10/2024
Kathie Herod
39 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first