2.4 Create and Apply Application Override Policies NETWORK-SECURITY-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A logistics company uses a custom tracking application that uses TCP port 7000. The administrator creates an application override for this traffic. After committing the changes, the administrator wants to verify that the override is working. What is the most reliable method to verify this?

   • AUse the 'show session info' command on the firewall.
   • BReview the application override configuration to ensure it is correct.
   • CCheck the system logs for any commit errors.
   • DGenerate test traffic and check the traffic logs for the application classification.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An administrator has created an application override for a custom application on TCP port 4000. The override is applied to a security rule. After committing, the administrator wants to verify that the override is working. What is the most appropriate tool to use for verification?

   • AUse the 'Application Command Center' (ACC) to view application usage.
   • BUse the 'Objects' tab to review the application override configuration.
   • CUse the 'Monitor' tab in the firewall web interface to view traffic logs.
   • DUse the 'Policies' tab to review the security rule.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   How does an application override policy affect traffic classification?

   • AIt only affects logging, not the actual application classification.
   • BIt allows the firewall to classify traffic using both App-ID and the override, choosing the most specific match.
   • CIt requires the application to be identified by App-ID before the override can apply.
   • DIt forces the firewall to classify matching traffic as the specified application, regardless of App-ID's detection.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A government agency uses a custom application that is not recognized by the firewall. The administrator creates an application override and applies it to a security rule. However, the traffic is still not matching the rule. What should the administrator check first?

   • ACheck if the firewall's application signatures are up to date.
   • BVerify that the application override is associated with the correct security rule.
   • CConfirm that the application override uses the correct source and destination IP addresses.
   • DEnsure that the security rule is placed above any deny rules.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A hospital uses a legacy telemedicine application that transmits video over TCP port 8443, but the firewall consistently classifies the traffic as 'ssl' because the application uses TLS. The security team needs the traffic to be identified as the custom 'telemedicine-app' application so that a specific security rule with QoS marking can match it. What should the administrator configure?

   • ACreate an application override policy that maps TCP port 8443 to the 'telemedicine-app' application and reference it in the security rule.
   • BAdd a security rule with a custom service object for TCP port 8443 and assign it to the 'telemedicine-app' application.
   • CDisable SSL decryption on the firewall so the application can be identified by its signature.
   • DModify the existing security rule to use the 'ssl' application instead of the custom application.
   Reveal Solution Discussion Select an answer first