An MSSP customer reports that the attacker used a proxy, encryption, and a tunnel, and the path to the sensor is direct. Which technique hides the bytes from deep inspection?
Select an answer to reveal the explanation.
Short Explanation
A mask changes who you see, a crate changes the wrapping, and a blackout hides the contents. You want the technique that hides bytes from deep inspection on a direct path, and that is encryption. The trap is picking the proxy, the tunnel, or a SPAN port for a job they do not do.
Full Explanation
Deep inspection needs to read application bytes. On a direct path the sensor already sees the flow, and encryption is what makes those bytes unreadable. The technique that hides the bytes is "Encryption that hides the application bytes even when the path to the sensor is direct". A proxy changes the apparent source of the connection. That matters for who appears to connect, and it is not what conceals bytes once the path is direct, so "A proxy that changes who appears to connect and is treated as the technique hiding the bytes" fails. A tunnel changes the wrapper around the traffic. Changing the outer protocol is not the same as hiding the inner bytes on a direct path, so "A tunnel that changes the outer wrapper around the traffic the sensor is watching" fails. A SPAN port copies frames to a monitor destination so they can be inspected. It does not conceal payload and it does not drop the original, so "A SPAN port on the monitoring switch, offered as the method that hides those bytes" fails. Exam caveat: a tunnel can also carry ciphertext, and the hiding of the bytes is still the encryption, not the wrapper by itself. Operational check: on the direct path, determine whether the application bytes are ciphertext before treating the proxy or the tunnel as the reason deep inspection failed.