Question

A security architect wants to detect malware communication inside TLS-encrypted flows across the campus network without decrypting the traffic and without deploying inline devices. The team already exports NetFlow from Catalyst switches to Cisco Secure Network Analytics (Secure Network Analytics). Which capability should the architect enable to meet this requirement?

Accepted Answer

Encrypted Traffic Analytics (ETA) to analyze flow metadata such as the initial data packet and sequence of packet lengths and times

Answer

A decryption policy on the switches to expose the payload of every TLS session for signature inspection

Answer

SPAN sessions mirroring all traffic to a full packet-capture appliance for offline payload reconstruction

Answer

URL filtering with reputation scoring applied to the HTTPS SNI field at the network edge