300-415 Question 225
Select 2While configuring an SD-WAN deployment, an enterprise wants to enhance its security by integrating Cisco Advanced Malware Protection (AMP) with the solution. Which of the following considerations are critical when enabling AMP in a Cisco SD-WAN environment?
- A
Ensure that the SD-WAN devices are running a software version compatible with AMP integration.
- B
Enable AMP scanning only on the transport interfaces used for direct internet access.
- C
Configure a Cloud-Delivered Security Services (CDSS) subscription to activate AMP functionality.
- D
Verify that AMP policies are applied at the data plane level for all traffic, including encrypted traffic.
- E
Ensure that AMP is integrated with Cisco Umbrella for DNS-layer filtering.
Show answer and explanation
Correct answers: A, C
Explanation
To integrate AMP successfully into Cisco SD-WAN, it is essential to ensure compatibility of the SD-WAN devices' software version and activate AMP functionality through a Cloud-Delivered Security Services (CDSS) subscription. These steps enable AMP to scan traffic effectively, enhancing the security posture of the SD-WAN deployment. Other options, such as limiting AMP to specific interfaces or requiring integration with Cisco Umbrella, are not mandatory considerations for AMP functionality.
- A. Correct.
Correct: AMP functionality requires the SD-WAN devices to run a compatible software version. Without this, AMP integration cannot be enabled.
- B. Incorrect.
Incorrect: AMP scanning is not limited to transport interfaces used for direct internet access. It operates based on the policies applied and traffic flow.
- C. Correct.
Correct: A Cloud-Delivered Security Services (CDSS) subscription is required to activate features such as AMP in Cisco SD-WAN.
- D. Incorrect.
Incorrect: AMP does not directly apply policies at the data plane for encrypted traffic. Other mechanisms, such as decryption, need to be in place for detailed inspection.
- E. Incorrect.
Incorrect: AMP integration with Cisco Umbrella is not mandatory. While both can complement each other, they are configured and operate independently.