A company is implementing automated threat response using FMC remediation rules. Which of the following are common remediation actions that can be performed by remediation rules? (Select all that apply.)

Quarantine a host via an access control system like ISE.

Block an IP address on a firewall.

Terminate a user session on a VPN concentrator.

Change the firewall's routing table.

Modify the intrusion prevention system's signature database.

A security operations center (SOC) wants to automatically block a source IP when a correlation rule detects a port scan followed by a brute-force attempt within 5 minutes. How should the SOC configure FMC to achieve this?

Create two separate correlation rules, one for each event, and manually block the IP.

Use an intrusion rule to block the IP after the first event.

Configure a syslog alert to notify the SOC to block the IP.

Create a correlation rule that triggers on the pattern and link it to a remediation rule that blocks the IP.

After deploying a new correlation rule and associated remediation rule, the security team finds that the remediation rule is blocking legitimate users because the correlation rule triggers too easily. What is the best first step to tune the rules and reduce false positives?

Increase the severity of the correlation rule to require more events.

Disable the remediation rule and keep the correlation rule active.

Review the correlation rule's conditions and time window, and adjust them to be more specific.

Change the remediation action to send an email instead of blocking.

CCIE Security

Domain 1Objective 12

1.12 Correlation and Remediation Rules on Cisco FMC CCIE-SECURITY Practice Questions (Page 8)

Part of the 1.0 Perimeter Security and Intrusion Prevention domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

9concepts

20%of the exam

Questions 36–38

36application · medium · select all that apply
A company is implementing automated threat response using FMC remediation rules. Which of the following are common remediation actions that can be performed by remediation rules? (Select all that apply.)
Select an answer first
37application · medium
A security operations center (SOC) wants to automatically block a source IP when a correlation rule detects a port scan followed by a brute-force attempt within 5 minutes. How should the SOC configure FMC to achieve this?
Select an answer first
38application · medium
After deploying a new correlation rule and associated remediation rule, the security team finds that the remediation rule is blocking legitimate users because the correlation rule triggers too easily. What is the best first step to tune the rules and reduce false positives?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.

1.12 Correlation and Remediation Rules on Cisco FMC CCIE-SECURITY Practice Questions (Page 8)

Questions 36–38

A company is implementing automated threat response using FMC remediation rules. Which of the following are common remediation actions that can be performed by remediation rules? (Select all that apply.)

A security operations center (SOC) wants to automatically block a source IP when a correlation rule detects a port scan followed by a brute-force attempt within 5 minutes. How should the SOC configure FMC to achieve this?

After deploying a new correlation rule and associated remediation rule, the security team finds that the remediation rule is blocking legitimate users because the correlation rule triggers too easily. What is the best first step to tune the rules and reduce false positives?

Keep studying — 1.0 Perimeter Security and Intrusion Prevention