300-710 · Question #91
An organization has noticed that malware was downloaded from a website that does not currently have a known bad reputation. How will this issue be addresses globally in the quickest way possible and…
The correct answer is D. by creating a URL object in the policy to block the website. The quickest and least impactful way to address malware from an unknown website is to create a URL object in the security policy to specifically block that website.
Question
An organization has noticed that malware was downloaded from a website that does not currently have a known bad reputation. How will this issue be addresses globally in the quickest way possible and with the least amount of impact?
Options
- Aby denying outbound web access
- BCisco Talos will automatically update the policies.
- Cby Isolating the endpoint
- Dby creating a URL object in the policy to block the website
How the community answered
(19 responses)- A5% (1)
- B11% (2)
- C5% (1)
- D79% (15)
Why each option
The quickest and least impactful way to address malware from an unknown website is to create a URL object in the security policy to specifically block that website.
Denying all outbound web access would have a severe and unacceptable impact on legitimate business operations.
While Cisco Talos updates threat intelligence, relying solely on an automatic update might not be immediate enough for a newly identified threat, and it doesn't represent the quickest direct action the administrator can take.
Isolating the endpoint is a response measure for an infected device, not a preventative measure for blocking the source website globally across the network.
Creating a URL object and adding it to an existing access control policy allows for immediate and precise blocking of the specific malicious website. This method has a minimal impact as it only affects traffic to the identified bad site, allowing legitimate traffic to continue flowing.
Concept tested: URL filtering for immediate threat response
Source: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/policies-and-rules.html
Topics
Community Discussion
No community discussion yet for this question.