An organization's current firewall permits outbound TCP 443 for everyone. It cannot tell a sanctioned SaaS application from a file-sharing site that uses the same port, or which employee generated the traffic. What should replace it?
Select an answer to reveal the explanation.
Short Explanation
A port number is just the door a visitor used, not who they are or what they're carrying. A next-generation firewall checks the visitor's ID (user) and looks in the bag (application, URL, threats). Every other answer still sorts traffic by door number, and that's the trap you need to dodge.
Full Explanation
Traditional stateful firewalls make decisions from addresses, ports and connection state. When many applications share TCP 443, those attributes cannot distinguish a sanctioned SaaS service from a file-sharing site, and IP addresses alone do not say which person is behind a session. A next-generation firewall such as Cisco Secure Firewall adds application visibility and control, identifying applications from traffic characteristics regardless of port; user identity, by mapping sessions to directory users through an identity source; URL filtering by category and reputation; and intrusion prevention and file or malware inspection. Policy can then permit the sanctioned application for a specific group while blocking file sharing. More granular port ranges in a stateful firewall still key on ports and cannot see that two different applications share 443. Extended ACLs on a router match the same Layer 3 and Layer 4 fields and add no application or user awareness. A stateless packet filter is less capable than the current firewall; TCP flags indicate connection phase, not application. Exam caveat: identification of applications inside encrypted sessions may rely on TLS metadata such as server name, while full content inspection requires decryption. Operational check: after deployment, review connection events for the application, user and URL fields populating on 443 traffic.