300-215 Question 150
Single answerDuring an investigation, your organization discovered that an attacker is using advanced malware to exfiltrate sensitive data via encrypted traffic. You need to recommend a Cisco security solution that can detect and prevent such threats while analyzing encrypted traffic without decrypting it. Which solution would you recommend?
- A
Cisco Umbrella
- B
Cisco Secure Endpoint
- C
Cisco Secure Network Analytics
- D
Cisco Identity Services Engine (ISE)
Show answer and explanation
Correct answer: C
Explanation
Cisco Secure Network Analytics is the most appropriate solution for detecting and preventing advanced threats in encrypted traffic. By leveraging features like Encrypted Traffic Analytics (ETA), it can identify malicious activity without decrypting the data, ensuring both security and privacy. Other Cisco solutions, while effective for their specific purposes, do not address the given scenario effectively.
- A. Incorrect.
Cisco Umbrella provides DNS-layer security but is not designed to analyze encrypted traffic or detect advanced threats directly in the network.
- B. Incorrect.
Cisco Secure Endpoint focuses on endpoint protection and malware detection on devices but does not specialize in analyzing encrypted traffic in real-time.
- C. Correct.
Cisco Secure Network Analytics (formerly Stealthwatch) uses advanced behavioral analysis and machine learning to identify threats in encrypted traffic without requiring decryption. It is well-suited for detecting and preventing such attacks.
- D. Incorrect.
Cisco Identity Services Engine (ISE) is a network access control solution and does not specialize in threat detection or prevention in encrypted traffic.