300-215 Question 169
Select 3During an incident, your organization suspects that a malicious domain is being used to exfiltrate data from internal systems. Which Cisco security solutions can assist in identifying and blocking communication with this domain, while also providing threat intelligence to confirm its malicious nature?
- A
Cisco Umbrella
- B
Cisco Firepower
- C
Cisco Secure Endpoint
- D
Cisco Secure Network Analytics
Show answer and explanation
Correct answers: A, B, D
Explanation
In this scenario, Cisco Umbrella can block DNS requests to a malicious domain, Cisco Firepower can block malicious traffic through its intrusion prevention and URL filtering capabilities, and Cisco Secure Network Analytics can detect suspicious traffic patterns related to the domain. While Cisco Secure Endpoint is critical for endpoint-level detection and response, it is not directly involved in domain-level threat intelligence and blocking.
- A. Correct.
Cisco Umbrella provides DNS-layer security and can block malicious domains by analyzing DNS requests, which is effective for preventing communication with known or suspected malicious domains.
- B. Correct.
Cisco Firepower includes intrusion prevention and URL filtering capabilities that can block malicious traffic, including connections to suspicious domains, based on threat intelligence.
- C. Incorrect.
Cisco Secure Endpoint focuses on endpoint protection and detecting/mitigating malware on devices but does not directly identify or block malicious domains.
- D. Correct.
Cisco Secure Network Analytics monitors network traffic patterns and can identify anomalous behavior, such as unexpected communication with malicious domains, by leveraging threat intelligence.