nerdexam
Cisco

300-710 · Question #91

An organization has noticed that malware was downloaded from a website that does not currently have a known bad reputation. How will this issue be addresses globally in the quickest way possible and…

The correct answer is D. by creating a URL object in the policy to block the website. The quickest and least impactful way to address malware from an unknown website is to create a URL object in the security policy to specifically block that website.

Configuration

Question

An organization has noticed that malware was downloaded from a website that does not currently have a known bad reputation. How will this issue be addresses globally in the quickest way possible and with the least amount of impact?

Options

  • Aby denying outbound web access
  • BCisco Talos will automatically update the policies.
  • Cby Isolating the endpoint
  • Dby creating a URL object in the policy to block the website

How the community answered

(19 responses)
  • A
    5% (1)
  • B
    11% (2)
  • C
    5% (1)
  • D
    79% (15)

Why each option

The quickest and least impactful way to address malware from an unknown website is to create a URL object in the security policy to specifically block that website.

Aby denying outbound web access

Denying all outbound web access would have a severe and unacceptable impact on legitimate business operations.

BCisco Talos will automatically update the policies.

While Cisco Talos updates threat intelligence, relying solely on an automatic update might not be immediate enough for a newly identified threat, and it doesn't represent the quickest direct action the administrator can take.

Cby Isolating the endpoint

Isolating the endpoint is a response measure for an infected device, not a preventative measure for blocking the source website globally across the network.

Dby creating a URL object in the policy to block the websiteCorrect

Creating a URL object and adding it to an existing access control policy allows for immediate and precise blocking of the specific malicious website. This method has a minimal impact as it only affects traffic to the identified bad site, allowing legitimate traffic to continue flowing.

Concept tested: URL filtering for immediate threat response

Source: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/policies-and-rules.html

Topics

#URL filtering#Malware prevention#Security policy management#Content filtering

Community Discussion

No community discussion yet for this question.

Full 300-710 Practice