An administrator wants application control to block peer-to-peer file sharing traffic that hops between non-standard ports to evade port-based rules. Which characteristic of application control makes it suited to this requirement?
- AIt rewrites the service object on the policy so that only the registered ports for each application remain open.
- BIt forces all peer-to-peer sessions through the explicit web proxy where they can be matched by URL category.
- CIt blocks any session whose packet rate exceeds the configured threshold for peer-to-peer behaviour.
- DIt uses deep packet inspection to match traffic against application signatures regardless of the TCP or UDP port in use. Correct
Why A is wrong: Application control does not modify policy service objects; this describes port-based filtering, the very approach the evasive traffic defeats.
Why B is wrong: Peer-to-peer traffic is not URL-based and is not routed through the web proxy by application control, so URL categories cannot identify it; this confuses web filtering with application control.
Why C is wrong: Application control matches on signatures, not on a packet-rate threshold, so rate-based blocking is a plausible-sounding but incorrect description of the mechanism.
Why D is correct: Application control inspects packet payloads and behaviour against the application database, so it identifies the application from its signature even when it uses random or non-standard ports.