Which security device blocks HTTP exfiltration over port 53?
The CIRT is reviewing an incident that involved a human resources recruiter exfiltrating sensitive company data. The CIRT found that the recruiter was able to use HTTP over port 53 to upload documents to a web server. Which of the following security infrastructure devices could have identified and blocked this activity?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests the ability to differentiate NGFW deep packet inspection from port-based firewall rules; the trap is assuming port 53 always indicates DNS traffic instead of recognizing HTTP tunneling through it.
The correct answer is NGFW utilizing application inspection because it can identify HTTP traffic even on non-standard ports like 53. Community consensus strongly supports option B, emphasizing application-layer awareness over port-based filtering.
Choosing UTM or WAF is common because they sound comprehensive or web-focused, but UTM relies on threat feeds and WAF focuses on web attacks rather than exfiltration over alternate ports.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
A Next-Generation Firewall (NGFW) with application inspection is designed to identify the actual application, not just the port. As comment [1] notes, it provides "application-level awareness to detect and block HTTP traffic over non-standard ports, such as port 53." This capability directly addresses the recruiter's misuse of HTTP over DNS port, enabling the CIRT to enforce policies that stop data exfiltration.
NGFWs perform deep packet inspection (DPI) and can match traffic against known application signatures, regardless of port number. This means even if HTTP is tunneled over port 53, the NGFW can decode and classify it as web traffic and apply blocking rules.
Comment [2] reinforces that NGFWs "inspect and identify traffic based on the application layer, not just the port and protocol," which exactly matches the incident's requirement.
Why the Other Options Are Wrong
A. WAF utilizing SSL decryption: A Web Application Firewall protects web applications from attacks like SQL injection and XSS, but it is typically positioned in front of web servers and does not reliably detect tunneled outbound HTTP on port 53. SSL decryption alone does not solve the non-standard port issue.
C. UTM utilizing a threat feed: Unified Threat Management combines multiple security functions, but relying on a threat feed would only block known malicious domains/IPs, not the exfiltration of sensitive data over HTTP through port 53 unless the feed specifically lists that destination. It lacks robust application inspection.
D. SD-WAN utilizing IPSec: Software-Defined WAN is primarily a WAN connectivity and optimization solution. IPSec provides encryption for traffic, but it does not inspect application content or block non-standard port usage.
Community Comment Notes
All commenters who answered selected B, with 100% vote distribution reflecting strong consensus. Comment [1] and [2] provide detailed reasoning about application-level inspection. Comment [3] is a simple acronym list, showing that even without explanation, the candidate recognized the distinction. The unanimity indicates this is a straightforward concept for well-prepared exam takers.
Official Reference
Exam Strategy
Focus on understanding the core difference between NGFW application inspection and traditional port-based firewalls. When you see a scenario involving traffic on a non-standard port, think about which device can inspect the application layer regardless of port number—that is typically the NGFW.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →