What is the recommended way to ensure that firewalls have the most current set of signatures for up-to-date protection?

Question

Options

• ARun a Perl script to regularly check for updates and alert when one is released
• BMonitor update announcements and manually push updates to Crewall
• CStore updates on an intermediary server and point all the firewalls to it
• DUse dynamic updates with the most aggressive schedule required by business needs

• A
  5% (1)
• B
  10% (2)
• C
  14% (3)
• D
  71% (15)

Explanation

Dynamic updates with an aggressive schedule (D) is the recommended approach because it automates the process of keeping firewall signatures current, minimizes the window of vulnerability, and aligns update frequency with actual business risk requirements - all without human intervention delays.

Why the distractors fail:

• A (Perl script for alerts) only notifies you of updates; it doesn't apply them, leaving the firewall unprotected until someone acts on the alert.
• B (Manual monitoring and pushing) is error-prone and slow - humans miss announcements, take vacations, and introduce lag that attackers can exploit.
• C (Intermediary server) addresses distribution architecture but doesn't solve the core problem of how frequently updates are fetched and applied; it's a partial solution, not the recommended method.

Memory tip: Think of it as a phone that auto-updates its apps vs. one you have to manually check. Dynamic updates = auto-update mode. The phrase "most aggressive schedule required by business needs" is key exam language - it signals that the update cadence should be driven by your risk posture, not convenience.

No community discussion yet for this question.