Refer to the exhibit. An engineer configured a default segmentation policy in Cisco Secure Workload to block SMTP traffic. During testing, it is observed that the SMTP traffic is still allowed…

Question

Exhibit

Options

• AAdd "port": [25, 25] to _rootScope
• BAdd _SMTPScope to provider_filter_ref
• CAdd "port": [25, 25] to _params
• DChange consumer_filter_ref to: _SMTPScope

• A
  5% (1)
• B
  19% (4)
• C
  71% (15)
• D
  5% (1)

Explanation

In Cisco Secure Workload's default segmentation policy, _params is where traffic-matching parameters - including port ranges - must be defined. Without specifying "port": [25, 25] in _params, the policy engine has no instruction to match SMTP traffic (TCP port 25), so the block action is never triggered and traffic passes through.

Why the distractors are wrong:

• A is wrong because _rootScope defines the scope boundary (which workloads are included), not the port/protocol parameters for a policy rule.
• B is wrong because provider_filter_ref identifies the destination workload group - changing it alters who receives traffic, not what traffic is matched.
• D is wrong because consumer_filter_ref identifies the source workload group - again, this changes who sends traffic, not which ports are filtered.

Memory tip: Think of _params as the "what" (what traffic to act on - ports/protocols), while consumer_filter_ref and provider_filter_ref are the "who" (source and destination workloads). You must define the "what" in _params before the policy can enforce anything on a specific protocol like SMTP.

No community discussion yet for this question.