The security engineer reviews the syslog server events of an organization and sees many outbound connections to malicious sites initiated from hosts running Cisco Secure Endpoint. The hosts are on a…

Question

Options

• AModify the policy on Cisco Secure Endpoint to enable DFC.
• BModify the access control policy on the Cisco FMC to block malicious outbound connections
• CAdd the IP addresses of the malicious sites to the access control policy on the Cisco FMC
• DAdd a Cisco Secure Endpoint policy with the Tetra and Spero engines enabled

• A
  80% (33)
• B
  2% (1)
• C
  12% (5)
• D
  5% (2)

Explanation

Cisco Secure Endpoint with DFC enabled can block malicious outbound connections by correlating device network flows and enforcing blocks directly on the endpoints, even if those endpoints are on a separate network from the Cisco Firepower Threat Defense (FTD) device. Modifying the access control policy on Cisco FMC (Firepower Management Center) or adding IP addresses to FMC policies would not block connections from hosts on a separate network that the FMC/FTD does not directly control. Enabling DFC in Secure Endpoint allows the endpoint agent to block connections to malicious IPs or domains based on threat intelligence and policy, which is effective for hosts outside the FTD's https://docs.amp.cisco.com/en/SecureEndpoint/Secure%20Endpoint%20User%20Guide.pdf

No community discussion yet for this question.