350-201 Question 246
Select 3You are a security analyst tasked with automating the process of identifying and isolating suspicious IP addresses from a firewall log. A provided Python script partially automates this task by parsing the logs and listing IP addresses exceeding a defined threshold of failed login attempts. However, you need to modify the script to automatically block these IP addresses using Cisco Firepower's REST API. Which modification would you include in the script to achieve this?
- A
Include a function to authenticate with the Cisco Firepower Management Center (FMC) REST API and obtain a token.
- B
Add a loop to parse and extract only valid IP addresses from the firewall logs.
- C
Integrate a POST request to the FMC REST API to create a new access control rule blocking the suspicious IP addresses.
- D
Implement error handling to ensure the script logs any failed API requests or connectivity issues.
- E
Hardcode the IP addresses to block directly into the script for easier maintenance.
Show answer and explanation
Correct answers: A, C, D
Explanation
To automate the process of blocking suspicious IP addresses, the script must authenticate with the Cisco FMC REST API, send a POST request to create a new access control rule, and handle potential errors during API communication. These modifications ensure that the task is completed dynamically and reliably. Parsing IPs and hardcoding addresses are either already part of the given script or counterproductive to automation goals.
- A. Correct.
Correct. Authenticating with the Cisco Firepower Management Center (FMC) REST API is essential for sending API requests, such as blocking IP addresses.
- B. Incorrect.
Incorrect. While parsing valid IP addresses is part of the initial script and important for log analysis, it is unrelated to automating the interaction with the REST API.
- C. Correct.
Correct. A POST request to the FMC REST API is required to create or update access control rules that block the suspicious IP addresses.
- D. Correct.
Correct. Implementing error handling ensures the script is robust and can log any issues that occur during API communication, making troubleshooting easier.
- E. Incorrect.
Incorrect. Hardcoding IP addresses would make the script less dynamic and is not a recommended practice for automating tasks based on real-time data.