300-215 Question #92: Real Exam Question with Answer & Explanation

Question

A security team receives a notification from the SIEM solution that Cisco Secure Network Analytics detects abnormally high uploads from an internal workstation to external IP addresses via UDP port 53. The security team investigates and determines that these IP addresses are known malicious C2 servers. Which two actions effectively block these connections and prevent similar incidents? (Choose two.)

Options

• ADeploy an anti-malware solution on the next-generation firewall.
• BConfigure firewall security intelligence to block C2 traffic.
• CAllow DNS traffic only to trusted destinations.
• DAdd malicious sources to the blacklist.
• EBlock all UDP port 53 connections from the company network to the Internet.