300-415 Question 219
Single answerAn organization has deployed Cisco SD-WAN and enabled the Intrusion Prevention System (IPS) feature on its branch devices. The security team has observed some malicious traffic bypassing the IPS inspection. Upon further investigation, they discovered that the bypassed traffic belongs to an application that is not classified by the SD-WAN application-aware policy. What action should the team take to ensure the traffic is inspected by IPS?
- A
Enable DPI (Deep Packet Inspection) for unclassified traffic in the IPS configuration.
- B
Manually add the application to the SD-WAN application-aware policy.
- C
Modify the IPS policy to block all unclassified traffic.
- D
Update the IPS signature database and redeploy the policy.
Show answer and explanation
Correct answer: A
Explanation
In Cisco SD-WAN, the IPS feature inspects traffic for malicious activity. However, if traffic is unclassified by the application-aware policy, it may bypass IPS inspection. Enabling DPI for unclassified traffic ensures that even unidentified traffic is analyzed by IPS, mitigating potential security risks. This action is critical for maintaining comprehensive security coverage.
- A. Correct.
Correct. Enabling DPI for unclassified traffic ensures that any traffic not identified by the SD-WAN application-aware policy is still inspected by IPS.
- B. Incorrect.
Incorrect. While manually adding the application might help in identifying it for other policies, it does not directly address the need for IPS to inspect unclassified traffic.
- C. Incorrect.
Incorrect. Blocking all unclassified traffic can severely disrupt business operations and is not a recommended approach in this scenario.
- D. Incorrect.
Incorrect. Updating the IPS signature database is a good practice, but it does not solve the issue of unclassified traffic bypassing IPS inspection.