350-201 Question 111
Select 3During an internal security assessment, you are tasked with configuring Cisco Secure Firewall to mitigate potential lateral movement of threats within the network. Which combination of features should you prioritize to achieve this goal effectively?
- A
Enable Segmentation using Access Control Policies
- B
Configure Intrusion Prevention System (IPS) for east-west traffic inspection
- C
Activate URL Filtering to block malicious websites
- D
Implement Identity-Based Firewalling to enforce user-specific policies
- E
Enable VPN Load Balancing for distributed traffic management
- F
Configure Malware Protection with file trajectory analysis
Show answer and explanation
Correct answers: A, B, D
Explanation
To mitigate lateral movement within the network, it is crucial to focus on features that control and monitor internal traffic. Segmentation using Access Control Policies limits traffic between network segments, while IPS inspects and blocks malicious activities in east-west traffic. Identity-Based Firewalling adds another layer of control by enforcing user-specific policies. These combined measures significantly reduce the risk of threats propagating within the network.
- A. Correct.
Segmentation using Access Control Policies is essential to limit lateral movement by defining boundaries between network segments and controlling traffic between them.
- B. Correct.
Intrusion Prevention System (IPS) for east-west traffic inspection helps detect and block malicious activities occurring between systems within the network, reducing the risk of lateral movement.
- C. Incorrect.
While URL Filtering is useful for controlling web access, it primarily addresses external threats rather than mitigating lateral movement within the network.
- D. Correct.
Identity-Based Firewalling enforces policies based on user identity, which can restrict unauthorized lateral movement based on user roles.
- E. Incorrect.
VPN Load Balancing is unrelated to mitigating lateral movement as it focuses on optimizing external VPN connections rather than internal network security.
- F. Incorrect.
Malware Protection with file trajectory analysis is more focused on detecting and analyzing malicious files rather than directly addressing lateral movement.