300-415 Question 214
Single answerAn organization has implemented Cisco SD-WAN and wants to use the application-aware enterprise firewall feature to block specific types of applications from traversing their SD-WAN fabric. The administrator configures a policy to block social media applications like Facebook and Twitter. After deploying the policy, users report that they can still access these applications. What is the most likely reason for this issue?
- A
The application-aware enterprise firewall policy was not attached to the correct VPN.
- B
The application signatures required for identifying social media applications are outdated.
- C
The firewall policy was configured at the data plane instead of the control plane.
- D
The application-aware enterprise firewall only supports predefined applications and cannot block social media traffic.
Show answer and explanation
Correct answer: B
Explanation
The Cisco SD-WAN application-aware enterprise firewall uses application signatures to detect and block specific applications. If the signatures are outdated, the firewall cannot correctly identify traffic such as social media applications, leading to the policy being ineffective. Regular updates to application signatures are essential to ensure the correct operation of the firewall feature.
- A. Incorrect.
Incorrect: While attaching the policy to the correct VPN is crucial, the issue described suggests a problem with detection, not policy application.
- B. Correct.
Correct: The application-aware enterprise firewall relies on accurate and updated application signatures to identify and block specific traffic. Outdated signatures could result in the firewall failing to detect the intended applications.
- C. Incorrect.
Incorrect: The application-aware enterprise firewall operates at the data plane, and there is no misconfiguration mentioned in the scenario that would suggest this as the root cause.
- D. Incorrect.
Incorrect: The application-aware enterprise firewall supports blocking social media traffic as long as the underlying application signatures are up-to-date.