1.12 Correlation and Remediation Rules on Cisco FMC CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A large enterprise has multiple FMC-managed sensors. The security team wants to create a correlation rule that detects a multi-stage attack: first, a port scan from an external IP, followed by a brute-force attempt on a specific server within 10 minutes. The rule should only trigger if the same source IP is involved in both stages. The team also wants to minimize false positives from legitimate scanning tools. What is the best approach?

   • ACreate two separate correlation rules, one for port scan and one for brute-force, and manually correlate the alerts.
   • BCreate a correlation rule with two triggers (port scan and brute-force) and a condition that both events share the same source IP, with a time window of 10 minutes.
   • CSet the time window to 60 minutes to catch slower attacks.
   • DUse a single trigger for brute-force and ignore the port scan.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security architect is designing an automated response system. A correlation rule detects a compromised host attempting to communicate with a command-and-control (C2) server. The architect wants to block the host's IP on the firewall and also quarantine the host via ISE. However, the remediation rule can only perform one action per trigger. What should the architect do to achieve both actions?

   • ACreate a custom script that performs both actions and call it from the remediation rule.
   • BUse a single remediation rule that performs both actions sequentially.
   • CModify the correlation rule to directly block the host and quarantine via ISE.
   • DCreate two remediation rules, each triggered by the same correlation rule, one for firewall block and one for ISE quarantine.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company uses FMC with multiple remediation modules, including ASA, ISE, and a third-party SIEM. The security team wants to ensure that when a correlation rule triggers, the remediation rule blocks the IP on the ASA and sends a notification to the SIEM. However, the SIEM module is not available in the FMC's remediation module list. What is the best alternative to achieve the SIEM notification?

   • ASkip the SIEM notification and rely on the FMC alert.
   • BCreate a custom remediation module using the FMC API.
   • CConfigure the correlation rule to send a syslog message to the SIEM in addition to triggering the remediation rule.
   • DUse the ASA module to send a syslog to the SIEM.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security administrator is configuring a remediation rule to block a malicious IP on an ASA firewall. The rule will be triggered by a correlation rule that detects a high rate of intrusion events. The administrator wants to ensure that the block is temporary and automatically expires after 1 hour to avoid permanently blocking a potentially legitimate IP. What should the administrator configure?

   • ASet the remediation rule to use a time-based ACL with a 1-hour expiration.
   • BUse the ASA's 'shun' command with a timeout parameter.
   • CConfigure the remediation rule to remove the block after 1 hour using a second remediation rule.
   • DSet the correlation rule to automatically expire after 1 hour.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company has a remediation rule that blocks a source IP on the ASA when a correlation rule detects a brute-force attack. However, the attacker is using a botnet with rotating IP addresses, so the block is ineffective. The security team wants to improve the response. What is the most effective remediation action to add?

   • ABlock the entire subnet of the attacker.
   • BAdd a remediation rule that terminates the user's VPN session.
   • CIncrease the block time to 24 hours.
   • DUse a remediation rule to quarantine the target server.
   Reveal Solution Discussion Select an answer first