300-415 Question 227
Single answerYou are configuring Cisco SD-WAN for a customer who requires enhanced security for file transfers across the WAN. They want to ensure that malicious files can be detected and blocked before reaching their destination. Using Cisco AMP integration with SD-WAN, what is a necessary step to achieve this?
- A
Enable the 'File Analysis' feature on the vManage dashboard and configure AMP policies.
- B
Configure an IPSec tunnel between vEdge devices and Cisco AMP cloud for secure file scanning.
- C
Activate AMP on the vEdge or cEdge devices and apply a security policy to inspect traffic.
- D
Enable AMP on the SD-WAN controllers and synchronize it with Cisco Umbrella for threat intelligence.
Show answer and explanation
Correct answer: C
Explanation
Cisco AMP (Advanced Malware Protection) is integrated with Cisco SD-WAN by enabling AMP on edge devices (vEdge or cEdge) and applying security policies to inspect and analyze traffic for malicious files. This ensures that threats can be detected and mitigated before they reach their destination. Configuration does not involve SD-WAN controllers or additional tunneling mechanisms, making option 3 the correct choice.
- A. Incorrect.
This option does not correctly describe the configuration process for AMP in Cisco SD-WAN. AMP is integrated through security policies applied to the SD-WAN edges, not by simply enabling a 'File Analysis' feature in vManage.
- B. Incorrect.
This option is incorrect as there is no requirement to configure an IPSec tunnel between vEdge devices and the AMP cloud for file scanning. Cisco AMP integration is handled through security policies and does not rely on IPSec tunnels for functionality.
- C. Correct.
This is the correct answer. Activating AMP on the vEdge or cEdge devices and applying a security policy ensures that traffic is inspected for malicious files. The policy enables the AMP engine to analyze files and block threats.
- D. Incorrect.
This option is incorrect because AMP is not enabled on SD-WAN controllers. While Cisco Umbrella provides DNS-layer protection and complements AMP, it is not directly tied to enabling AMP in the SD-WAN environment.