試験NetSec-Analyst トピック2 問題19 スレッド

A. Create a Custom Application for QUIC traffic specifying UDP port. Create a Security Policy rule allowing this custom application. Configure an SSL Decryption Policy for this traffic. Apply relevant Content-ID profiles.

B. QUIC is UDP-based; therefore, SSL decryption is not applicable. Create a Custom Application for QUIC traffic specifying UDP port. Create a Security Policy rule allowing this custom application. Apply relevant Content-ID profiles without SSL decryption.

C. QUIC traffic uses a different handshaking mechanism than traditional SSL/TLS over TCP, making direct SSL decryption challenging for the firewall's standard SSL Proxy. The best approach is to use an Application Override for the QUIC traffic to identify it, then apply a specific Content-ID profile that bypasses SSL decryption but focuses on other threat prevention aspects. A Security Policy rule allowing this traffic is also needed.

D. QUIC traffic, by its nature, integrates encryption directly at the transport layer. While a custom App-ID can identify it (if supported by signatures or application override), standard SSL decryption profiles designed for TCP-based SSL/TLS will not function directly on QUIC. A Security Policy rule allowing the custom App-Ld (or the 'quic' App-ID if recognized by the firewall) with appropriate Content-ID profiles (Antivirus, Anti-Spyware, WildFire) is required, but explicit SSL Decryption is generally not applied in the same manner as TCP.

E. Upgrade the PAN-OS to the latest version which has native support for QUIC decryption. Then, create a Security Policy rule allowing the 'quic' application and apply an SSL Decryption Profile along with Content-ID profiles. If the application is custom, a Custom App-ID might still be required.