350-201 Question 47
Single answerA security analyst is configuring an Intrusion Prevention System (IPS) on a Cisco Firepower device. The organization requires the IPS to detect and block known malicious traffic patterns while minimizing the impact on legitimate traffic. Which technique should the analyst prioritize when configuring the IPS to meet these requirements?
- A
Enable and configure signature-based detection rules.
- B
Implement anomaly-based detection with custom thresholds.
- C
Use statistical modeling to evaluate traffic behavior.
- D
Enable sandboxing to analyze suspicious files in a controlled environment.
Show answer and explanation
Correct answer: A
Explanation
Signature-based detection is the most appropriate technique in this scenario because it is designed to identify and block known malicious traffic patterns effectively while reducing false positives. Its reliance on a database of signatures ensures precise detection and minimal disruption to legitimate traffic, aligning with the organization's requirements.
- A. Correct.
Signature-based detection is highly effective for identifying known malicious traffic patterns by matching them against a database of signatures. This approach minimizes false positives and is ideal for blocking known threats.
- B. Incorrect.
Anomaly-based detection can identify deviations from normal traffic behavior but is prone to higher false positives, which may disrupt legitimate traffic. It is less suitable when minimizing impact on legitimate traffic is a priority.
- C. Incorrect.
Statistical modeling is useful for understanding traffic trends and detecting irregularities over time but is not as effective in immediately detecting and blocking known malicious patterns.
- D. Incorrect.
Sandboxing is a method for analyzing files and isolating threats but is not directly related to detecting and blocking traffic patterns in real time.