A control at a university reads the HTTP body looking for a script tag and does not stop its decision at the destination port. Which inspection mode is that control using?
Select an answer to reveal the explanation.
Short Explanation
You’re using deep packet inspection when the control reads the HTTP body and matches a script tag instead of stopping at the destination port. Packet filtering looks only at headers, stateful tracking remembers the connection but ignores the body, and NetFlow sampling keeps conversation summaries rather than the body. That distinction helps you avoid mistaking header or connection awareness for content inspection.
Full Explanation
Deep packet inspection reads the HTTP body and can match a script tag found there. Because the control looks past the destination port into application content, it can make a decision based on the script tag; this is different from relying only on headers or remembering that a connection exists. Packet filtering that decides from headers alone and leaves the HTTP body unread stops at information such as addresses and ports, so it cannot find a script tag inside the body. Stateful tracking that remembers the connection and still ignores the HTTP body records that a connection exists, but connection memory does not search the body for a script tag. NetFlow sampling that records conversation summaries and does not keep the HTTP body stores details such as who talked to whom and how much, not the body where the script tag could be read. Exam caveat: a body match works only when the sensor can see the HTTP body; if TLS still hides it, the script tag is unavailable to the rule. Practical check: confirm that the rule matches the script-tag pattern in clear HTTP and that the sensor actually receives the body, rather than only the destination port.