350-201 Question 236
Select 3Your organization uses Cisco SecureX orchestration to automate threat response workflows. A recent phishing attack resulted in malicious IP addresses being identified. You are tasked with automating the blocking of these IP addresses on Cisco Firepower Threat Defense (FTD) devices. Which automation steps should you include in your SecureX workflow to achieve this?
- A
Create a SecureX orchestration action to fetch the list of malicious IPs from a threat intelligence feed.
- B
Use a Cisco Firepower Threat Defense API call to block the malicious IP addresses.
- C
Manually log in to the Cisco FTD console to input the IP addresses for blocking.
- D
Set up a scheduled SecureX orchestration workflow to periodically update the block list on Cisco FTD.
- E
Configure an email alert to notify the SOC team after the IPs are blocked.
Show answer and explanation
Correct answers: A, B, D
Explanation
Automating the blocking of malicious IPs on Cisco FTD using SecureX requires fetching the IP list from a feed, leveraging the Cisco FTD API for automated blocking, and scheduling the workflow to ensure continuous updates. Manual tasks contradict the automation goal, and optional steps like email alerts, while helpful, are not required for the primary task.
- A. Correct.
Correct: Fetching the list of malicious IPs from a threat intelligence feed is a crucial first step in automating the response workflow.
- B. Correct.
Correct: Using the Cisco FTD API is an effective method to automatically block malicious IP addresses via SecureX orchestration.
- C. Incorrect.
Incorrect: Manually logging into the Cisco FTD console goes against the principle of automation and is not part of a SecureX workflow.
- D. Correct.
Correct: Setting up a scheduled workflow ensures that the block list remains updated and automated over time.
- E. Incorrect.
Incorrect: While notifying the SOC team is useful, it is not essential to the IP blocking automation itself. This step is optional and not directly tied to the workflow's purpose.