700-765 · Question #46
How is Cisco Security able to dynamically add IP addresses of known malware domains to its list of ports to detect and block?
The correct answer is A. Reputation Filtering. Cisco Reputation Filtering dynamically updates and maintains lists of IP addresses and domains associated with malware, spam, and malicious activity using real-time threat intelligence feeds.
Question
How is Cisco Security able to dynamically add IP addresses of known malware domains to its list of ports to detect and block?
Options
- AReputation Filtering
- BLayer-4 Monitoring
- CData Loss Prevention
- DURL Filtering
How the community answered
(29 responses)- A93% (27)
- B3% (1)
- C3% (1)
Why each option
Cisco Reputation Filtering dynamically updates and maintains lists of IP addresses and domains associated with malware, spam, and malicious activity using real-time threat intelligence feeds.
Reputation Filtering in Cisco security products (such as ESA and WSA) uses continuously updated Sender Base / TALOS reputation scores to automatically block connections to known malicious IP addresses and domains without requiring manual rule updates.
Layer-4 Monitoring tracks outbound TCP connections to detect malware callbacks at the transport layer but does not dynamically maintain or update IP reputation lists.
Data Loss Prevention is focused on identifying and preventing sensitive data from leaving the organization, not on blocking inbound/outbound connections to malicious IPs.
URL Filtering blocks access to categorized web URLs and sites but operates on full URLs rather than dynamically updated IP address reputation lists for malware domains.
Concept tested: Cisco Reputation Filtering for malware domain blocking
Source: https://www.cisco.com/c/en/us/td/docs/security/esa/esa14-0/user_guide/b_ESA_Admin_Guide_14-0/b_ESA_Admin_Guide_12_1_chapter_0100.html
Topics
Community Discussion
No community discussion yet for this question.