1.12 Correlation and Remediation Rules on Cisco FMC CCIE-SECURITY Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is a valid action that can be configured for a correlation rule on Cisco FMC?

   • AReboot the managed device
   • BModify the access control policy
   • CGenerate an alert
   • DChange the FMC administrator password
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the purpose of configuring an action like 'drop packets' in a correlation rule?

   • ATo immediately block malicious traffic as part of the response to a detected threat
   • BTo log the event for later analysis without taking any immediate action
   • CTo update the intrusion rule database
   • DTo change the routing table on the FMC
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of a remediation rule on Cisco FMC?

   • ATo configure the network discovery policy
   • BTo update the malware signature database
   • CTo generate detailed reports for compliance auditing
   • DTo automate responses to detected threats by performing actions such as blocking or quarantining
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst at a large enterprise notices that the FMC event viewer is flooded with thousands of individual intrusion events from multiple sensors, making it difficult to identify a coordinated attack. The analyst wants to reduce noise and get a single alert when a specific pattern of events occurs across the network within a short time window. What should the analyst configure in FMC?

   • AAn intrusion rule that drops all packets matching the attack pattern.
   • BA remediation rule that automatically blocks the source IP of the first event.
   • CA correlation rule that aggregates matching events and triggers an alert when the condition is met.
   • DA custom event view that filters out low-severity events.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A network team wants to create a correlation rule that detects a distributed denial-of-service (DDoS) attack by aggregating events from multiple sensors. The rule should trigger when any single source IP sends more than 1,000 packets to a single destination within 1 minute. What is the most efficient way to define this rule in FMC?

   • AUse an intrusion rule that counts packets per source IP.
   • BUse a correlation rule with a trigger for the packet event, a condition for the count, and a time window of 1 minute.
   • CConfigure a custom event view to show the top talkers.
   • DCreate a separate correlation rule for each sensor and then combine them.
   Reveal Solution Discussion Select an answer first