2.2 Identify the types of data provided by these technologies
📘Cisco Certified CyberOps Associate (200-201 CBROPS)
Definition:
Application Visibility and Control (AVC) is a technology that allows IT security and network teams to see which applications are running on a network, understand how much bandwidth each is using, and control or limit application usage based on policies.
It’s not just about websites; it’s about all network traffic that applications generate, such as file-sharing apps, collaboration tools, video conferencing, or cloud services.
1. Why AVC is Important
In an IT environment, there are often hundreds of applications running at the same time. Not all applications are safe or business-relevant. AVC helps organizations:
- Identify applications on the network.
- Monitor usage — see which apps consume the most bandwidth.
- Control access — allow, block, or limit applications based on business policies.
- Detect risky behavior — catch unauthorized apps that could be security threats.
Example in IT terms: AVC can detect if employees are using unauthorized cloud storage apps, which could lead to data leakage, and allow admins to block them.
2. How AVC Works
AVC uses Deep Packet Inspection (DPI) and network monitoring to classify and control application traffic. Here’s how:
- Traffic Identification:
AVC examines network traffic and identifies the application generating it. This is done by checking signatures, protocols, and behavior patterns of network packets. - Traffic Classification:
Once identified, traffic is classified into categories such as:- Business-critical apps (e.g., ERP, email systems)
- Collaboration apps (e.g., Teams, Zoom)
- Non-business apps (e.g., personal social media)
- Risky apps (e.g., peer-to-peer file sharing)
- Monitoring and Control:
After classification, administrators can:- Allow the application fully.
- Restrict it (limit bandwidth or priority).
- Block it completely.
3. Types of Data Provided by AVC
AVC collects useful data that helps with network monitoring and security:
- Application Name and Type:
Identifies the application generating traffic. Example: Microsoft Teams, Zoom, Slack, Dropbox. - Traffic Volume:
How much bandwidth each application is using. This helps spot applications consuming excessive resources. - User Information:
Links application usage to specific users or devices. Example: which user is using Slack the most. - Application Risk Level:
AVC can assign risk scores to apps based on known vulnerabilities or policies. - Trends Over Time:
Shows historical data of application usage, helping IT teams plan network capacity.
4. Key Features of AVC
Here are the main features your exam may focus on:
| Feature | Description |
|---|---|
| Application Discovery | Detects applications on the network, even unknown or encrypted ones. |
| Traffic Classification | Groups applications by type, usage, or risk level. |
| Application Control | Allows, blocks, or throttles applications based on policy. |
| Bandwidth Management | Prioritizes business-critical apps over non-essential apps. |
| Reporting | Generates logs and reports on application usage and trends. |
5. How AVC is Used in an IT Environment
In a network, AVC helps IT teams secure and optimize the environment:
- Network Optimization: Prioritize ERP traffic over file-sharing apps to keep critical apps fast.
- Security Enforcement: Block risky apps like unauthorized file-sharing or malware-hosting apps.
- Compliance: Ensure employees are using approved business applications.
- Incident Response: Detect unusual application traffic that may indicate a security breach.
6. Exam Tips
When studying AVC for the exam, focus on:
- AVC monitors, identifies, and controls applications.
- It provides detailed network data, including application name, volume, risk, and user.
- Key concepts: Application discovery, classification, control, and reporting.
- AVC uses deep packet inspection (DPI) to understand traffic at the application level.
- It can prioritize, block, or limit applications depending on policies.
Tip: Remember, AVC is about visibility first, control second. You need to see applications before you can control them.
✅ Summary in Simple Words
- AVC = “See what apps are on my network, how much they are used, and control them.”
- Helps IT admins secure, manage, and optimize the network.
- Provides data on apps, users, bandwidth, and risk.
- Uses deep packet inspection to classify traffic.
- Can allow, limit, or block apps based on business policies.
