How is Cisco Security able to dynamically add IP addresses of known malware domains to its list of ports to detect and block?

Question

Options

• AReputation Filtering
• BLayer-4 Monitoring
• CData Loss Prevention
• DURL Filtering

• A
  88% (28)
• B
  3% (1)
• C
  6% (2)
• D
  3% (1)

Explanation

Reputation Filtering maintains a continuously updated threat intelligence database of IP addresses and domains associated with malware, botnets, and other threats. When Cisco's threat intelligence network identifies a new malicious domain, its IP address is dynamically pushed to all participating Cisco security devices in near-real-time, enabling automatic blocking without manual administrator intervention.

Why the distractors are wrong:

• B (Layer-4 Monitoring) inspects TCP/UDP traffic by port numbers and connection states - it doesn't maintain or dynamically update malware IP lists.
• C (Data Loss Prevention) focuses on preventing sensitive data (SSNs, credit cards) from leaving the network - it's about outbound data classification, not blocking malicious inbound IPs.
• D (URL Filtering) blocks URLs based on content categories (gambling, adult content, etc.) - while it can block malicious URLs, it operates on web addresses, not dynamically updated IP reputation lists.

Memory tip: Think of Reputation Filtering as a crowdsourced credit score for IP addresses - Cisco's global sensor network constantly reports bad actors, and every device sharing that reputation feed instantly knows who to block. If it "knows" the IP is bad by reputation, it blocks it dynamically.

No community discussion yet for this question.