1.12 Correlation and Remediation Rules on Cisco FMC CCIE-SECURITY Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which statement best describes how correlation rules function in Cisco FMC?

   • AThey combine events from one or more sources and apply conditions to detect a security incident
   • BThey only work with events from the Firepower Next-Generation Firewall, not from other sources
   • CThey are used to configure the network discovery policy for the FMC
   • DThey evaluate a single event and immediately trigger an alert based on that event alone
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following are the three main components of a correlation rule on Cisco FMC?

   • ATriggers, conditions, and variables
   • BRules, policies, and profiles
   • CSources, destinations, and ports
   • DAlerts, reports, and dashboards
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In a Cisco FMC correlation rule, what is the role of a 'trigger'?

   • AIt specifies the action to take when the rule matches
   • BIt defines the event or set of events that cause the rule to begin evaluating conditions
   • CIt determines how long the rule remains active after a match
   • DIt stores the IP addresses of the managed devices
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Where in the Cisco FMC web interface would you go to create a new correlation rule?

   • ADevices > Platform Settings
   • BPolicies > Correlation
   • CObjects > Object Management
   • DAnalysis > Intrusions > Events
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   When creating a correlation rule in FMC, which of the following must you specify?

   • AA time window and a variable
   • BA trigger and at least one condition
   • CA remediation module and a blocking action
   • DAn alert destination and a syslog server
   Reveal Solution Discussion Select an answer first