300-215 Question 145
Single answerDuring an investigation, your security team identifies a malicious IP address communicating with internal hosts. Threat intelligence reports classify the IP as part of a known botnet infrastructure. Using Cisco SecureX and Cisco Umbrella, what is the most appropriate response to mitigate the threat based on the intelligence artifact?
- A
Block the malicious IP address at the firewall and configure Cisco Umbrella to block all traffic associated with the botnet domain.
- B
Send an alert to the users communicating with the malicious IP and recommend they disconnect from the network.
- C
Monitor the IP address for further activity without taking immediate action to avoid disrupting business operations.
- D
Quarantine the affected internal hosts and disable their network access until further investigation is complete.
Show answer and explanation
Correct answer: A
Explanation
Using intelligence artifacts such as threat reports, the most appropriate response is to block both the malicious IP and any related botnet domains at multiple enforcement points. Cisco SecureX and Cisco Umbrella provide comprehensive tools to act on such intelligence, ensuring the threat is contained effectively while minimizing risk to the organization.
- A. Correct.
Blocking the malicious IP at the firewall and using Cisco Umbrella to block traffic associated with the botnet domain is the most effective response to prevent further communication with the threat actor while leveraging intelligence artifacts.
- B. Incorrect.
Sending an alert to users is not sufficient to mitigate the threat, as the malicious IP could continue to interact with internal hosts.
- C. Incorrect.
Monitoring without taking immediate action increases the risk of further compromise or data exfiltration, which is not an acceptable response in this scenario.
- D. Incorrect.
Quarantining hosts may help contain the threat locally, but it does not address the need to block external communication with the botnet infrastructure, making it an incomplete response.