A university wants Zoom and Workday to take the low-latency path while YouTube and bulk downloads take broadband, but port-based rules keep misclassifying traffic because apps use dynamic ports and CDNs. Policy must match applications reliably before app-aware routing acts. Which classification approach correctly feeds application-aware routing for these dynamic apps?
Select an answer to reveal the explanation.
Short Explanation
Chasing ports for cloud apps is like sorting mail by envelope color. DPI classification reads the actual application signature so your policy routes the right traffic.
Full Explanation
DPI-based application lists correctly feed app-aware routing because they identify Zoom, Workday, and YouTube by payload signatures and behavioral heuristics rather than static ports or addresses, which directly solves the stated dynamic-port and CDN misclassification problem and supplies the reliable application match that routing policy then acts upon to place interactive traffic on low-latency and bulk traffic on broadband. The data-prefix approach using publisher CIDRs is operationally common for stable data centers but fails by concept because cloud and CDN addresses rotate constantly and are shared across tenants and regions, so lists go stale and over-match or under-match unrelated traffic. The FQDN-based SaaS list approach is widely used for web filtering and SaaS steering but fails here because DNS names and SNI overlap heavily on shared CDNs, are increasingly obscured by encrypted DNS and ECH, and do not provide the DPI application identifier that app-aware routing expects as its match criterion. The SLA-class approach with latency, loss, and jitter thresholds is essential for defining which tunnel meets low-latency versus broadband objectives but fails by concept because it defines path quality without classifying which application should use which path, leaving the required matching step unfulfilled. For exams, carefully separate classification constructs from path-selection and liveness constructs, since prompts emphasizing dynamic ports and CDNs signal that DPI application awareness is required. As a practical check, stage the lists in monitor mode, generate controlled Zoom, Workday, and YouTube sessions, then confirm correct application hits and path selections with application-aware routing statistics and DPI flow counters before enforcing changes.