Palo Alto Networks Certified Cybersecurity Entry-level Technician (PCCET)Network SecurityMedium
A cybersecurity analyst is investigating a suspected malware infection that is attempting to communicate with an external command-and-control (C2) server. The analyst observes encrypted traffic leaving the network on non-standard ports. Which network security technology is BEST suited to detect and potentially block this type of anomalous, encrypted communication based on its content or behavior, even if the port is unusual?
- ADemilitarized Zone (DMZ)
- BNext-Generation Firewall (NGFW)
- CIntrusion Detection System (IDS)
- DStateful firewall
Show answer & explanationAnswer & explanation
Correct answer: B. Next-Generation Firewall (NGFW)
A Next-Generation Firewall (NGFW) offers deep packet inspection, application awareness, and threat intelligence capabilities that allow it to identify and control applications and detect malicious traffic, even when it's encrypted or using non-standard ports. This goes beyond the capabilities of traditional stateful firewalls or IDSs.
Why the other options are wrong
- A. A DMZ is a network segment for public-facing services, not a technology for detecting and blocking malicious encrypted traffic.
- C. An IDS can detect anomalies but often relies on signatures or specific patterns; an NGFW can actively block based on application and threat intelligence.
- D. A stateful firewall primarily inspects header information and connection state, not application content or encrypted traffic on non-standard ports.
Next-Generation Firewall (NGFW)
A deep-packet inspection firewall that moves beyond port/protocol inspection and blocking to add application-level inspection, intrusion prevention, and advanced threat intelligence.
- Combines traditional firewall capabilities with advanced features.
- Provides application awareness and control.
- Integrates Intrusion Prevention System (IPS) and threat intelligence.
- Can inspect encrypted traffic (with SSL decryption).
Memory trick: NGFW is like a smart security guard who knows what everyone is doing, not just where they're going.