1.12 Correlation and Remediation Rules on Cisco FMC CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security team wants to automate the response to a detected ransomware infection. When a correlation rule detects the infection, the FMC should automatically isolate the infected host from the network. Which remediation action should be configured?

   • ASend an email alert to the IT department.
   • BBlock the host's IP on the ASA firewall.
   • CTerminate the host's VPN session.
   • DQuarantine the host using an ISE remediation module.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An organization wants to detect a potential data exfiltration attempt. The security team creates a correlation rule that triggers when a host sends more than 100 MB of data to an external IP within 10 minutes. After deploying the rule, they notice it fires too frequently due to legitimate large file transfers. What should they do to reduce false positives while still detecting real exfiltration?

   • AIncrease the time window to 30 minutes and raise the threshold to 500 MB.
   • BChange the action to drop packets instead of generating an alert.
   • CDisable the rule and rely on manual monitoring.
   • DAdd a condition to exclude traffic to known cloud storage IP addresses.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security engineer is configuring a correlation rule in FMC to respond to a detected malware outbreak. The rule should automatically block the infected host's IP address on the network. What action should the engineer configure in the correlation rule to achieve this?

   • ASet the correlation rule to send a syslog message to the firewall.
   • BUse the correlation rule's built-in 'block host' action directly.
   • CGenerate an alert and trigger a remediation rule that blocks the host.
   • DConfigure the intrusion policy to drop all traffic from the host.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company wants to automate the response to a detected brute-force attack. When a correlation rule detects the attack, the FMC should automatically block the attacking IP address on the ASA firewall for 24 hours. What should the administrator configure?

   • AA remediation rule that uses the ASA module to add a temporary block.
   • BA correlation rule that directly modifies the ASA access-list.
   • CA syslog alert that an administrator manually acts upon.
   • DAn intrusion rule that drops packets from the attacker.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security analyst needs to configure a remediation rule in FMC to quarantine a host that has been identified as infected by a correlation rule. The quarantine should be implemented by blocking the host's IP on the network. What must the analyst specify in the remediation rule?

   • ASelect the remediation module (e.g., ASA) and define the action (block IP).
   • BConfigure the FMC to send an email notification.
   • CSet the correlation rule to generate an alert.
   • DDefine a trigger event and a time window.
   Reveal Solution Discussion Select an answer first