2.4 Create and Apply Application Override Policies NETWORK-SECURITY-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company uses a custom application that communicates over both TCP and UDP on port 7000. The administrator creates an application override for TCP port 7000. After testing, the administrator notices that UDP traffic on port 7000 is not being classified as the custom application. What is the most likely reason?

   • AThe firewall does not support application overrides for UDP traffic.
   • BThe UDP traffic is being blocked by a security rule before the override can take effect.
   • CThe application override needs to be applied to a separate security rule for UDP traffic.
   • DThe application override only matches TCP traffic because the protocol was specified as TCP.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company has two custom applications: 'app1' uses TCP port 1000, and 'app2' uses TCP port 1001. The administrator needs to create application overrides for both. The security team wants to ensure that traffic for 'app1' is allowed and traffic for 'app2' is blocked. What is the most efficient way to configure this?

   • ACreate two application overrides and two security rules: one allowing 'app1' and one blocking 'app2'.
   • BCreate two security rules without application overrides, using the source IP addresses to differentiate the applications.
   • CCreate one application override for 'app1' and use a security rule to block all other traffic on port 1001.
   • DCreate one application override for both applications and one security rule that allows both.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A university uses a research application that communicates over TCP port 5555. The firewall misclassifies this traffic as 'web-browsing'. The administrator needs to create an application override so that a security rule can apply a specific URL filtering profile to this traffic. What is the first step in creating this override?

   • AAdd a service object for TCP port 5555.
   • BConfigure a new application override policy with the source and destination zones.
   • CCreate a security rule that allows traffic on TCP port 5555.
   • DCreate a custom application object named 'research-app' in the Objects tab.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which log type would you examine to verify that an application override policy is correctly classifying traffic?

   • AThreat logs.
   • BTraffic logs.
   • CSystem logs.
   • DConfiguration logs.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company has a custom application that uses TCP port 5000. The administrator creates an application override and applies it to a security rule. The security rule is configured to allow the traffic. However, the traffic is still being blocked. What is the most likely reason?

   • AA deny rule above the allow rule is matching the traffic before the allow rule is evaluated.
   • BThe security rule is using the wrong source zone.
   • CThe application override is not committed.
   • DThe firewall's default action is to block all traffic.
   Reveal Solution Discussion Select an answer first