Which two policy components are required to block traffic in real time using a dynamic user group (DUG)? (Choose two.)

Question

Options

• AA Decryption policy to decrypt the traffic and see the tag
• BA Deny policy with the "tag" App-ID to block the tagged traffic
• CAn Allow policy for the initial traffic
• DA Deny policy for the tagged traffic

• A
  7% (3)
• B
  17% (7)
• C
  76% (32)

Explanation

Blocking traffic in real time with a Dynamic User Group (DUG) requires a two-phase policy setup. First, Option C (an Allow policy) is needed so that initial traffic flows through the firewall, enabling the system to observe user behavior, apply tags, and populate the DUG dynamically. Then Option D (a Deny policy targeting the tagged DUG) is placed above or evaluated after the allow, so once a user receives the trigger tag, subsequent traffic is immediately blocked in real time - this is the actual enforcement mechanism.

Option A is wrong because decryption is not a prerequisite for DUG-based blocking; DUGs operate on user/IP tags, not on inspecting encrypted payload content. Option B is wrong because "tag" is not a valid App-ID - the deny policy references the Dynamic User Group (which is based on tags) as the source user, not as an application identifier.

Memory tip: Think "Allow to tag, Deny to block" - the Allow policy is the sensor that lets traffic in so tagging can occur, and the Deny policy is the trap door that slams shut once the tag is applied.

No community discussion yet for this question.