642-825 Implementing Secure Converged Wide Area Networks Brain Dump

Demo Question 5.

Answer: B

Explanation: Signature-based pattern matching refers to searching for a fixed sequence of bytes in a single packet, or predefined content. As its name suggests, it is an approach that is fairly rigid but simple to employ. In most cases, the signature pattern is matched only if the suspect packet is associated with a particular service or, more precisely, destined to or from a particular port. This method lessens the amount of inspection done on every packet. However, it tends to make it more difficult for systems to deal with protocols that do not reside on well-defined ports, and, in particular, Trojan horses and their associated traffic, which can usually be moved at will. Initially, there might be many alerts, but which are no threat for the network. After the system is tuned and adjusted to the specific network parameters, there will be fewer false alerts than with the policy-based approach.