300-415 Question 216
Select 3Your organization has deployed Cisco SD-WAN across multiple branch locations. As a part of security enhancements, you are tasked to enable Intrusion Prevention System (IPS) functionality on specific branch routers. During the configuration, you notice that the IPS functionality is not working as expected. Which of the following actions should you take to ensure IPS is successfully operational on these devices?
- A
Verify that the branch devices are running a valid security policy with IPS enabled.
- B
Ensure the branch devices have a valid Cisco Umbrella subscription.
- C
Check that the devices are running the Cisco SD-WAN image that supports application-aware security features.
- D
Confirm the devices have sufficient resources (e.g., memory and CPU) to support IPS.
- E
Ensure the branch devices are integrated with Cisco AMP for Endpoints.
Show answer and explanation
Correct answers: A, C, D
Explanation
To enable IPS functionality in Cisco SD-WAN, a valid security policy with IPS enabled must be applied to the devices. Additionally, the devices must support the necessary security features, which are available only in specific Cisco SD-WAN image versions. Adequate hardware resources are also required to ensure IPS operates without performance issues. While Cisco Umbrella and Cisco AMP for Endpoints are valuable security tools, they are not prerequisites for enabling IPS.
- A. Correct.
Correct. IPS functionality requires a security policy applied to the devices with IPS explicitly enabled.
- B. Incorrect.
Incorrect. A Cisco Umbrella subscription is not required for IPS functionality as it pertains to DNS-layer security, not intrusion prevention.
- C. Correct.
Correct. The Cisco SD-WAN image must support advanced security features, including IPS. Older image versions may not include this functionality.
- D. Correct.
Correct. IPS can be resource-intensive, so the devices must have sufficient hardware resources to run it effectively.
- E. Incorrect.
Incorrect. Cisco AMP for Endpoints is a separate endpoint protection solution and is not required for enabling IPS in Cisco SD-WAN.