Refer to the exhibit. An engineer is investigating an issue by using Cisco Secure Cloud Analytics. The engineer confirms that the connections are unauthorized and informs the incident management…

Question

Exhibits

Options

• AReinstall the host from a recent backup.
• BQuarantine the host
• CReinstall the host from scratch.
• DCreate a firewall rule that has a source of linux-gcp-east-4c, a destination of Any, and a protocol of
• ECreate a firewall rule that has a source of Any, a destination of linux-gcp-east-4c, and a protocol of

• A
  7% (3)
• B
  76% (35)
• C
  15% (7)
• D
  2% (1)

Explanation

When unauthorized connections are confirmed targeting a host in Cisco Secure Cloud Analytics, the immediate priorities are containment and blocking - not recovery. Quarantining the host (B) isolates linux-gcp-east-4c from the network to stop lateral movement or ongoing exfiltration, which is the standard first containment action in incident response. Creating a firewall rule blocking traffic to linux-gcp-east-4c from Any source (E) directly addresses the confirmed unauthorized inbound connections, preventing further malicious access to the compromised host.

Why the distractors are wrong:

• A (reinstall from backup) and C (reinstall from scratch) are both recovery actions - they belong in a later phase of the incident response lifecycle, after containment and investigation are complete; jumping there skips critical steps.
• D (source = linux-gcp-east-4c, destination = Any) blocks outbound traffic from the compromised host, but the confirmed unauthorized activity was inbound connections to the host - the wrong traffic direction.

Memory tip: Remember the incident response order - Contain before Clean. Quarantine = contain, firewall block = contain. Reinstall = clean (comes later). For the firewall rule direction, ask "where are the bad connections going?" - they're going to linux-gcp-east-4c, so block that destination (Option E).

No community discussion yet for this question.