1.3 Create and Apply External Dynamic Lists NETWORK-SECURITY-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst has configured an External Dynamic List and applied it to a security policy rule. The analyst wants to confirm that the EDL is being used correctly in the policy. What is the best way to verify this?

   • ARestart the firewall to ensure the EDL is loaded.
   • BReview the EDL object's configuration to ensure the type is correct.
   • CPing the EDL source URL from the firewall to confirm connectivity.
   • DCheck the firewall's system logs for EDL download and parse status, and review traffic logs for matches.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Where can an administrator verify that an External Dynamic List has been successfully downloaded and parsed?

   • AIn the traffic logs only
   • BIn the threat prevention logs
   • CIn the system logs and the EDL object's status
   • DIn the configuration audit log
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst is explaining the benefits of External Dynamic Lists to a colleague. The colleague asks how an EDL differs from a static address object in a security policy. What is the key advantage of using an EDL?

   • AThe EDL can contain both IP addresses and domain names in the same list.
   • BThe EDL can be used in both Source and Destination Address fields simultaneously.
   • CThe EDL does not require a refresh interval to be configured.
   • DThe EDL automatically updates with new entries from the external source without manual intervention.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company wants to use an External Dynamic List to block traffic from IP addresses that are known to be part of a botnet. The list is updated by a third-party provider every 10 minutes. The security team wants to ensure the firewall always has the latest list. What is the most important configuration to achieve this?

   • ASet the refresh interval to 10 minutes or less.
   • BSet the EDL type to 'IP List'.
   • CReference the EDL in the Destination Address field.
   • DEnable logging on the security policy rule.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security team has an External Dynamic List containing malicious IP addresses. They apply it to a deny rule at the top of the rulebase. However, they notice that some traffic from these IPs is still being allowed. The analyst checks the EDL status and confirms it is downloading successfully. What is the most likely reason for the traffic being allowed?

   • AAn earlier allow rule in the rulebase is matching the traffic before the deny rule.
   • BThe EDL type is set to 'Domain List' instead of 'IP List'.
   • CThe refresh interval is set too high, so the list is stale.
   • DThe deny rule is using the EDL in the Destination Address field.
   Reveal Solution Discussion Select an answer first