A security team receives a notification from the SIEM solution that Cisco Secure Network Analytics detects abnormally high uploads from an internal workstation to external IP addresses via UDP port…

Question

Options

• ADeploy an anti-malware solution on the next-generation firewall.
• BConfigure firewall security intelligence to block C2 traffic.
• CAllow DNS traffic only to trusted destinations.
• DAdd malicious sources to the blacklist.
• EBlock all UDP port 53 connections from the company network to the Internet.

• A
  17% (7)
• B
  74% (31)
• D
  2% (1)
• E
  7% (3)

Explanation

Explanation

Options B and C work together to address both the immediate threat and prevent future incidents: configuring firewall security intelligence to block known C2 traffic (B) provides automated, intelligence-driven blocking of malicious destinations, while restricting DNS traffic only to trusted destinations (C) prevents DNS tunneling/exfiltration by ensuring DNS queries only reach legitimate, approved DNS servers - directly addressing the abnormal UDP 53 upload behavior detected.

Why the distractors are wrong:

• A – Anti-malware on a firewall doesn't specifically address C2 communication blocking or DNS-based exfiltration, making it too generic for this scenario.
• D – While blacklisting malicious sources is reactive and addresses only known IPs, it lacks the intelligence-driven, scalable approach of Security Intelligence feeds (essentially a subset of what B already accomplishes more effectively).
• E – Blocking all UDP port 53 to the Internet would break legitimate DNS resolution for the entire organization, causing massive service disruption - it's far too broad.

Memory Tip: Think "Block the Bad, Trust the Good" - Security Intelligence blocks known malicious destinations (B), and restricting DNS to trusted servers ensures only good traffic flows (C). Together they form a targeted defense without breaking legitimate services.

No community discussion yet for this question.