350-401 Question 287
Single answerYour organization has deployed Cisco Firepower Threat Defense (FTD) to enhance network security. During an investigation, you notice that certain malicious IP addresses are still able to access internal resources. Upon reviewing the configuration, you find that the Access Control Policy (ACP) is configured to 'Monitor Only.' Which action should you take to actively block these threats while ensuring legitimate traffic is not impacted?
- A
Change the ACP mode from 'Monitor Only' to 'Block' and deploy the policy.
- B
Enable intrusion prevention on the ACP and redeploy the policy.
- C
Configure a new firewall rule in the ACP specifically blocking the malicious IP addresses.
- D
Enable SSL decryption in the ACP to inspect encrypted traffic.
Show answer and explanation
Correct answer: A
Explanation
To actively prevent malicious traffic, the ACP mode must be set to 'Block.' When set to 'Monitor Only,' the policy will log and monitor traffic but won't take any action to block threats. Adjusting the ACP to 'Block' ensures enforcement of the defined security rules while allowing legitimate traffic to pass.
- A. Correct.
Correct. Changing the ACP mode to 'Block' will enforce the policy and actively block malicious traffic rather than just monitoring it.
- B. Incorrect.
Incorrect. While enabling intrusion prevention is important, it does not address the specific issue of enforcing the ACP to block malicious IPs.
- C. Incorrect.
Incorrect. While creating a specific rule to block malicious IPs might work, the issue lies in the ACP being set to 'Monitor Only,' which prevents enforcement.
- D. Incorrect.
Incorrect. Enabling SSL decryption is useful for inspecting encrypted traffic but does not address the primary issue of enforcing the ACP policy.