Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Palo Alto > Module 8 - App ID > Flashcards

Module 8 - App ID Flashcards

1
Q
A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is an application

A

Specific program whose communication can be labeled, monitored and controlled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How are applications identified via a firewall?

A

Application signatures, decryption, protocol decoding and heuristics, unknown traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How does App-ID identify TCP traffic?

A

It will assign an application label like gmail-base.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How many labels will App-ID assign an application using TCP?

A

5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the 5?

A

Not-applicable, incomplete, insufficient-data, unknown-tcp, or unknown-p2p

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does not-applicable mean?

A

Security policy does not allow it, traffic discarded

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What does incomplete mean?

A

3 way TCP handshake does not complete, or when handshake completes, but no data follows.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does insufficient-data mean?

A

Not enough data is received in the payload to identify an application.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What does unknown-tcp mean?

A

3 way TCP handshake completes, and data is flowing, but App-ID cannot identify the app

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does unknown-p2p mean?

A

App-ID cannot match traffic to a specific application, but the traffic exhibits generic peer-to-peer behavior

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How about UDP?

A

Often Palo Alto needs only the first packet to examine a single UDP packet to identify the app.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the three classifying UDP traffic

A

Not-applicable, unknown-udp or unknown-p2p

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is not-applicable

A

Firewall discards the traffic, security policy will not allow it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

what is unknown-udp

A

App-ID cannot identify the app

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is known-p2p

A

App-ID cannot match the UDP traffic to a specific app

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What happens if network traffic shifts from one application to another during a session?

A

App-ID cannot identify traffic from only a TCP SYN packet. Even after the three-way handshake, the firewall could report the traffic as insufficient-data UNLESS it detects HTTP GET, App-ID can initially report web-browsing, and further classify the traffic …. generic-app-base to generic-app-chat.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Are applications dependent on other applications?

A

Yes, network traffic can shift from one application to another during a session.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

If applications shift to another during a session, how is a firewall supposed to pick that up?

A

Dependencies - ensure the firewall allows the other applications on which the application depends.

20
Q

What is an example of a dependancy applicaiton?

A

Office on demand, depends on ms-office365-base, sharepoint applications, and ssl.

21
Q

Do applications implicitly used parent groups, etc

A

Yes, if you search under object - applications, type in the application. It will say either depends on and implicitly uses:

22
Q

What is an application group?

A

Unlike the dynamic list of applications in a filter, you can create an app group which is static, and can be added to multiple rules. Requires a commit.

23
Q

What are application filters, how does that differ from application group?

A

An app filter is an object that dynamically groups applications based on app attribute that you select from the App-ID database.

24
Q

What are the app filter selectable attributes?

A

Category, Subcategory, Risk, Tags and characterisitc

25
Q

What are predefined and Custom application tags?

A

Palo Alto assigns one or more tags to applications in App-ID - as part of the normal Threats content updates

26
Q

What is important to know about App-ID, what does it accomplish?

A

Reduces the attack surface. Only permitted apps are allowed to traverse the network.

27
Q

The firewall has three methods for identifying unknown traffic - what are they?

A

unknown-udp, unknown-tcp, uknown-p2p, web browsing

28
Q

How do we control unknown applications

A
  1. Block all 2. Use a packet capture to identify unique patterns in the app. Next create a custom app signature to match the bit pattern and name the new custom app. Creating a custom application. 3. Application Override policy rule
29
Q

Traffic that is encrypted with SSL - does that use different ports when encrypted?

A

Yes, with encrypted ssl, traffic can use different secure ports instead of standard ports.

30
Q

With PAN-OS 9.0, will policy rules allow applications on standard and secure ports with SSL?

A

Yes! The application-default setting has been extended to allow certain SSL-encrypted app’s on their defaul SSL secure ports.

31
Q

What about non-standard ports?

A

Malicious traffic uses non-standard apps.

32
Q

What is the app-default used for?

A

Blocks applications not running on standard ports. Under service tab

33
Q

What are the three options for the service column?

A

Application-default, any, and select.

34
Q

Can App-ID use signatures and decoders to identify applications in encrypted traffic?

A

No, but it relies on 2 things. 1 Common Name field in a cert (FQDN of the server or its IP) 2. TLS protocol extension named (multiple websites share an IP address)

35
Q

Do all websites have their own FQDN and IP address?

A

No, it is not practical, many web servers host multiple websites. Therefore the CN field of a certificate cannot be used to identify the application, because many web-based applications share a FQDN and IP address.

36
Q

What happens if the firewall cannot identify traffic using the CN field or the SNI field in the TLS handshake?

A

Traffic is identified as SSL

37
Q

When migrating port based rules to App-ID based rules, what changes?

A

Add appropriate application based rules, it improves security posture to an existing legacy rules.

38
Q

How many phases for bringing legacy port-based rules over to PAN-OS.

A

3

39
Q

What happens in phase 2?

A

After 30 days of logging traffic for only port-based rules, you now begin to add application based rules

40
Q

What happens in phase 1?

A

Policy Optimizer provides sorting option to help you prioritize rules

41
Q

What happens in Phase 3?

A

Final cleanup - review traffic logs and security policy rules to determine if traffic is matching legacy port-based rules. You remove al legacy rules here.

42
Q

Will content-ID work, if App-ID cannot identify the traffic?

A

No

43
Q

What are the three traffic types that App-ID labels as uknown?

A

Malware, internally developed apps, or commercially available apps

44
Q

Do App-ID and Content-ID depend on Content Updates?

A

Yes!

45
Q

When is the earliest you can use new application signatures when downloading from Applications and threats?

A

Commit operation required

46
Q

How about threat signatures, is a commit required?

A

No, ready immediately.

47
Q
A

Palo Alto (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions