300-710 · Question #23
Which description of a correlation policy configuration in the Cisco Firepower Management Center is true?
The correct answer is C. You cannot add a host profile qualification to a correlation rule that is triggered by a malware. In Cisco Firepower Management Center, a true statement regarding correlation policy configuration is that you cannot add a host profile qualification to a correlation rule triggered by a malware event.
Question
Which description of a correlation policy configuration in the Cisco Firepower Management Center is true?
Options
- AThe system displays correlation policies that are created on all of the domains in a multidomain
- BDeleting a response group deletes the responses of that group
- CYou cannot add a host profile qualification to a correlation rule that is triggered by a malware
- DCorrelation policy priorities override whitelist priorities
How the community answered
(25 responses)- A4% (1)
- B8% (2)
- C84% (21)
- D4% (1)
Why each option
In Cisco Firepower Management Center, a true statement regarding correlation policy configuration is that you cannot add a host profile qualification to a correlation rule triggered by a malware event.
Correlation policy priorities determine the evaluation order of correlation rules and do not override whitelist priorities, which typically grant explicit permission for traffic regardless of other policy considerations.
In a multidomain Firepower deployment, administrators typically only see correlation policies created within their assigned domain or domains, not across all domains for security and administrative isolation.
Cisco Firepower Management Center (FMC) correlation rules allow combining various event types and conditions, but a specific design limitation prevents the direct addition of a host profile qualification to a rule if its primary trigger is a malware event. Malware detections are fundamentally focused on the file's disposition, making host profile details less relevant as a direct trigger qualification for this specific event type in a correlation rule.
Deleting a response group removes the group itself, but whether the associated individual responses are also deleted depends on their configuration and whether they are referenced elsewhere, making the statement not universally true without further context.
Concept tested: Cisco FMC correlation policy host profile limitations
Topics
Community Discussion
No community discussion yet for this question.