1.12 Correlation and Remediation Rules on Cisco FMC CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security team is troubleshooting why a correlation rule is not triggering a remediation rule. The correlation rule fires and generates an alert, but the remediation rule does not execute. The remediation rule is enabled and correctly configured. What is the most likely cause?

   • AThe correlation rule is not linked to the remediation rule.
   • BThe correlation rule's action is set to 'alert only' and does not trigger remediation.
   • CThe time window of the correlation rule is too short.
   • DThe remediation module is not available on the FMC.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security analyst is testing a new correlation rule in a lab environment. The rule is designed to detect a specific attack pattern. The analyst wants to verify that the rule triggers correctly and that the associated remediation rule performs the intended action without affecting production. What is the best approach?

   • ACreate a copy of the rule with a very short time window to trigger quickly.
   • BDisable the remediation rule and only test the correlation rule.
   • CRun the correlation rule in 'test mode' with a simulated event stream and a remediation rule that only logs actions.
   • DDeploy the rule directly to production and monitor for false positives.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security administrator needs to create a correlation rule in FMC that triggers when a single host attempts to connect to more than 50 different destination ports within 5 minutes. The rule should generate an alert. What is the correct way to define this rule?

   • ASet the trigger to 'Intrusion Event' and use a variable for the port count.
   • BUse a custom event view to display the top ports and manually monitor.
   • CSet the trigger to 'Connection Event', add a condition for 'Destination Port Count > 50', and set the time window to 5 minutes.
   • DCreate a remediation rule that blocks the host after 50 connections.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company wants to automatically block a malicious IP address on their ASA firewall when a correlation rule detects a high number of intrusion events from that IP. The security team wants to ensure that the block is applied only after the correlation rule has triggered, not immediately upon the first event. What should they configure?

   • AA remediation rule that blocks the IP immediately upon any event.
   • BAn intrusion rule that blocks the IP after the first event.
   • CA syslog alert that instructs an administrator to manually block the IP.
   • DA correlation rule that triggers after the threshold is met and a remediation rule that blocks the IP on the ASA.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A network administrator is creating a correlation rule in FMC to detect a brute-force attack. The rule should trigger when more than 10 failed login attempts occur from the same source IP within 5 minutes. Which components must the administrator define in the correlation rule?

   • AA variable, a syslog server, and an email notification.
   • BA source interface, a destination interface, and a VPN tunnel.
   • CA remediation module, an action, and a target device.
   • DA trigger event, a condition for the number of events, and a time window.
   Reveal Solution Discussion Select an answer first