A network administrator uses Cisco Umbrella to protect internal users from malicious content. A customer is using an IPsec tunnel to connect to an Umbrella Organization. The administrator was…

Question

Options

• AWeb policy to block Remote Desktop Manager application type
• BFirewall policy and set port 3389 to be blocked for all outgoing traffic
• CData loss prevention policy to block all file uploads with RDP application mime type
• DDNS policy to block Remote Desktop Manager application type

• A
  16% (6)
• B
  70% (26)
• C
  8% (3)
• D
  5% (2)

Explanation

Option B is correct because Cisco Umbrella's cloud-delivered firewall operates at Layer 3/4 and can block traffic by port number. Since RDP exclusively uses TCP port 3389, blocking outbound port 3389 in a firewall policy will prevent all RDP connections from traversing the IPsec tunnel to the internet, directly addressing the exfiltration threat.

Why the distractors are wrong:

• A (Web policy): Web policies in Umbrella target HTTP/HTTPS traffic at Layer 7. RDP does not travel over HTTP, so a web policy will never inspect or block RDP connections.
• C (DLP policy): DLP policies scan content in web-based file uploads. RDP has no MIME type, and DLP cannot intercept raw TCP sessions on non-web ports - it wouldn't see the traffic at all.
• D (DNS policy): DNS policies block domain name resolution. RDP connections often target IPs directly (not hostnames), and even if a domain were resolved, blocking the DNS query wouldn't terminate the underlying TCP session on port 3389.

Memory tip: Match the tool to the layer - if the threat is a port, the fix is a firewall policy. Remember: "Port problem → Firewall policy; Domain problem → DNS policy; Web content problem → Web/DLP policy." RDP = port 3389 = firewall.

No community discussion yet for this question.