Refer to the exhibit. An engineer must create a segmentation policy in Cisco Secure Workload to block HTTP traffic. The indicated configuration was applied; however, HTTP traffic is still allowed…

Question

Exhibit

Options

• AChange consumer_filter_ref to HTTP Consumer.
• BAdd HTTP to 14_params.
• CDecrease the priority of the template to 50.
• DIncrease the priority of the template to 200.

• A
  15% (4)
• B
  73% (19)
• C
  4% (1)
• D
  8% (2)

Explanation

Option B is correct because in Cisco Secure Workload, l4_params (Layer 4 parameters) defines the specific ports and protocols the policy matches against - if HTTP (port 80) is not listed there, the policy simply never matches HTTP traffic, so it cannot block it regardless of any other configuration.

Why the distractors are wrong:

• A is wrong because consumer_filter_ref identifies which workloads are the traffic source, not what type of traffic is filtered - changing it would shift the policy's scope, not fix the protocol match.
• C is wrong because lowering priority doesn't help when the rule never matches HTTP in the first place; a higher-priority rule that doesn't match still does nothing.
• D is wrong for the same reason - adjusting priority only matters when competing rules conflict; it cannot make a rule match traffic it was never configured to catch.

Memory tip: Think of l4_params as the policy's "traffic fingerprint scanner" - if you don't register HTTP/port 80 in it, the scanner never recognizes HTTP packets and the rule stays idle. Always verify L4 params first when a Cisco Secure Workload policy fails to act on a specific protocol.

No community discussion yet for this question.