300-415 Question 242
Select 3A customer has implemented Cisco SD-WAN and wants to enhance DNS security to protect against domain-based threats such as phishing and malware. They are considering enabling DNS Security features. Which of the following statements correctly describe capabilities or actions related to DNS security in Cisco SD-WAN?
- A
Cisco SD-WAN can block access to malicious domains using real-time threat intelligence from Cisco Umbrella.
- B
DNS Security in Cisco SD-WAN automatically redirects all DNS queries to public DNS servers, bypassing the enterprise DNS servers.
- C
Administrators can configure DNS filtering policies in Cisco vManage to block specific domains or categories of domains.
- D
DNS Security in Cisco SD-WAN can only function if integrated with an external third-party DNS provider.
- E
DNS Security leverages Secure Internet Gateway (SIG) functionality to monitor and secure DNS traffic.
Show answer and explanation
Correct answers: A, C, E
Explanation
Cisco SD-WAN's DNS Security feature allows administrators to protect their network from domain-based threats by integrating with Cisco Umbrella, implementing DNS filtering policies in vManage, and leveraging SIG functionality. It does not bypass enterprise DNS servers or solely depend on third-party providers, ensuring flexibility and enhanced security.
- A. Correct.
Correct. Cisco SD-WAN integrates with Cisco Umbrella to block access to malicious domains using real-time threat intelligence, enhancing DNS security.
- B. Incorrect.
Incorrect. DNS Security does not automatically redirect DNS queries to public servers; it respects the enterprise's DNS infrastructure while applying security policies.
- C. Correct.
Correct. Administrators can use Cisco vManage to configure DNS filtering policies, allowing them to block specific domains or domain categories for security purposes.
- D. Incorrect.
Incorrect. While external providers such as Cisco Umbrella can enhance DNS Security, the feature does not solely rely on a third-party provider to function.
- E. Correct.
Correct. Cisco SD-WAN may leverage Secure Internet Gateway (SIG) features to monitor and secure DNS traffic by analyzing and applying security policies.