The Falcon sensor uses certificate pinning to defend against man-in-the-middle attacks. Which statement is TRUE concerning Falcon sensor certificate validation?
A.
SSL inspection should be configured to occur on all Falcon traffic
B.
Some network configurations, such as deep packet inspection, interfere with certificate validation
C.
HTTPS interception should be enabled to proceed with certificate validation
D.
Common sources of interference with certificate pinning include protocol race conditions and resource contention
The statement that some network configurations, such as deep packet inspection, interfere with certificate validation is true concerning Falcon sensor certificate validation. The Falcon sensor uses certificate pinning to defend against man-in-the-middle attacks, which means that it verifies that the server certificate presented by the Falcon cloud matches a hard-coded certificate embedded in the sensor. Some network configurations, such as deep packet inspection, SSL inspection, or HTTPS interception, may attempt to modify or replace the server certificate, which will cause the sensor to reject the connection and generate an error3.
References: 3: How to Become a CrowdStrike Certified Falcon Administrator
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit