300-415 Question 241
Single answerAn enterprise is using Cisco SD-WAN and has implemented DNS security to protect against malicious domains. The network administrator notices that despite enabling DNS security, some users are still able to access potentially harmful websites. What could be the reason for this issue, and how should it be resolved?
- A
The DNS security feature is not enabled on all the relevant SD-WAN policies.
- B
The DNS server used by the clients is not configured to work with Cisco Umbrella.
- C
The DNS security feature requires a separate license that has not been activated.
- D
The Cisco SD-WAN routers are not synchronized with the cloud-based DNS security database.
Show answer and explanation
Correct answer: B
Explanation
In Cisco SD-WAN, DNS security leverages Cisco Umbrella or other DNS-based threat intelligence solutions to block access to malicious domains. If the DNS server used by client devices is not properly configured to work with Cisco Umbrella, DNS requests will bypass the security features. To resolve this, the administrator should ensure that the DNS server used by clients is correctly pointing to Cisco Umbrella or a supported DNS security service.
- A. Incorrect.
While SD-WAN policies are critical for traffic management, DNS security operates independently of these policies once configured. This option is not the most likely cause of the issue.
- B. Correct.
If the DNS server used by clients does not point to Cisco Umbrella or a supported DNS security solution, DNS security cannot function properly. This is the correct answer.
- C. Incorrect.
While DNS security does require licensing, the question states it has already been enabled, meaning licensing is likely not the issue.
- D. Incorrect.
Synchronization issues with the cloud-based database could cause some delays in DNS resolution, but it would not allow access to malicious domains outright. Hence, this is not the primary cause of the issue.