nerdexam
Cisco

300-415 · Question #263

Refer to the exhibit. An engineer must block FTP traffic coming in from a particular Service VPN on a WAN Edge device. Which set of steps achieves this goal?

The correct answer is C. Create a prefix list, add it to the localized policy, and add it to the interface feature template. To block FTP traffic from a Service VPN on a WAN Edge device, an engineer should create an ACL within a localized policy, potentially using a prefix list for matching, and then apply this policy to the relevant interface feature template.

Policies

Question

Refer to the exhibit. An engineer must block FTP traffic coming in from a particular Service VPN on a WAN Edge device. Which set of steps achieves this goal?

Options

  • ACreate a localized policy and add it to the interface feature template.
  • BCreate a localized policy, add it to VPN template, and add an ACL to the interface feature template.
  • CCreate a prefix list, add it to the localized policy, and add it to the interface feature template.
  • DCreate a localized policy, add it to the device template, and add an ACL to the interface feature template.

How the community answered

(36 responses)
  • A
    8% (3)
  • B
    6% (2)
  • C
    72% (26)
  • D
    14% (5)

Why each option

To block FTP traffic from a Service VPN on a WAN Edge device, an engineer should create an ACL within a localized policy, potentially using a prefix list for matching, and then apply this policy to the relevant interface feature template.

ACreate a localized policy and add it to the interface feature template.

Creating a localized policy is the general first step, but it is too vague as it doesn't specify creating an ACL or the necessary matching criteria to block specific traffic like FTP.

BCreate a localized policy, add it to VPN template, and add an ACL to the interface feature template.

Applying a localized policy to a VPN template is not the correct mechanism for applying interface-level ACLs to block traffic, and the steps for ACL application are misaligned with standard SD-WAN practices.

CCreate a prefix list, add it to the localized policy, and add it to the interface feature template.Correct

This set of steps involves creating a prefix list to define IP addresses for matching, then integrating this into an Access Control List (ACL) that resides within a localized policy. This localized policy, containing the ACL to block FTP traffic, is then applied to the desired ingress interface via its feature template on the WAN Edge device.

DCreate a localized policy, add it to the device template, and add an ACL to the interface feature template.

While creating a localized policy and associating it with a device template is correct, choice C more specifically highlights the creation and integration of a prefix list, which is a key component for defining traffic matching within the ACL for blocking.

Concept tested: Localized policy ACL for traffic blocking

Source: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/sdwan-xe-release-17/sd-wan-security/sd-wan-security-book/security-firewall.html

Topics

#Localized Policy#Access Control List#WAN Edge Security#vManage Templates

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-415 Practice