The network team wants to block a peer-to-peer file-sharing application for all devices crossing the internet edge, including unmanaged devices that have no endpoint agent. The application changes ports dynamically. Which control fits best?
Select an answer to reveal the explanation.
Short Explanation
When the app hops ports, port ACLs are like guarding one door while it walks through another. The firewall's application recognition looks at the traffic itself, and it doesn't care whether the device has an agent. An endpoint allowlist is the trap: it only helps on machines you manage.
Full Explanation
Network-based application control, such as application visibility and control (AVC) on Cisco Secure Firewall, identifies applications by inspecting traffic patterns and protocol behavior rather than by port numbers. Access control rules can then block or rate-limit the identified application for every device whose traffic passes through the firewall, whether or not it is managed. This meets both requirements: dynamic ports do not evade identification, and unmanaged devices are covered because enforcement happens in the network path. An endpoint allowlist delivered by MDM controls only enrolled devices and leaves contractors, personal devices and IoT uncontrolled. A port-based ACL fails because the application negotiates ports dynamically and can fall back to common ports such as 80 or 443, so blocking defaults misses most sessions while risking collateral damage. Blocking DNS for the download site prevents new installations from that site but does not stop clients that are already installed or obtained elsewhere, and peer-to-peer traffic often connects directly to peers by IP. Exam caveat: encrypted traffic can limit application identification depth, so decryption policy may affect accuracy. Operational check: generate test traffic from the application and confirm the firewall's connection events identify it and show the block action.