nerdexam
Cisco

300-710 · Question #23

Which description of a correlation policy configuration in the Cisco Firepower Management Center is true?

The correct answer is C. You cannot add a host profile qualification to a correlation rule that is triggered by a malware. In Cisco Firepower Management Center, a true statement regarding correlation policy configuration is that you cannot add a host profile qualification to a correlation rule triggered by a malware event.

Configuration

Question

Which description of a correlation policy configuration in the Cisco Firepower Management Center is true?

Options

  • AThe system displays correlation policies that are created on all of the domains in a multidomain
  • BDeleting a response group deletes the responses of that group
  • CYou cannot add a host profile qualification to a correlation rule that is triggered by a malware
  • DCorrelation policy priorities override whitelist priorities

How the community answered

(25 responses)
  • A
    4% (1)
  • B
    8% (2)
  • C
    84% (21)
  • D
    4% (1)

Why each option

In Cisco Firepower Management Center, a true statement regarding correlation policy configuration is that you cannot add a host profile qualification to a correlation rule triggered by a malware event.

AThe system displays correlation policies that are created on all of the domains in a multidomain

Correlation policy priorities determine the evaluation order of correlation rules and do not override whitelist priorities, which typically grant explicit permission for traffic regardless of other policy considerations.

BDeleting a response group deletes the responses of that group

In a multidomain Firepower deployment, administrators typically only see correlation policies created within their assigned domain or domains, not across all domains for security and administrative isolation.

CYou cannot add a host profile qualification to a correlation rule that is triggered by a malwareCorrect

Cisco Firepower Management Center (FMC) correlation rules allow combining various event types and conditions, but a specific design limitation prevents the direct addition of a host profile qualification to a rule if its primary trigger is a malware event. Malware detections are fundamentally focused on the file's disposition, making host profile details less relevant as a direct trigger qualification for this specific event type in a correlation rule.

DCorrelation policy priorities override whitelist priorities

Deleting a response group removes the group itself, but whether the associated individual responses are also deleted depends on their configuration and whether they are referenced elsewhere, making the statement not universally true without further context.

Concept tested: Cisco FMC correlation policy host profile limitations

Topics

#Cisco Firepower#Correlation Policy#FMC#Rule Configuration

Community Discussion

No community discussion yet for this question.

Full 300-710 Practice