300-215 CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CybersecurityDemo

By Cisco · Question Mode

QuestionQ76

Incident Response Techniques

A security team is notified by the SIEM solution that Cisco Secure Network Analytics has detected abnormally high uploads from an internal workstation to external IP addresses over UDP port 53. The team investigates and determines that the IP addresses are known malicious C2 servers. Which two actions effectively block these connections and prevent similar incidents?

Choose two
  • A Deploy an anti-malware solution on the next-generation firewall.
  • B Configure firewall security intelligence to block C2 traffic.
  • C Allow DNS traffic only to trusted destinations.
  • D Add malicious sources to the blacklist.
  • E Block all UDP port 53 connections from the company network to the Internet.
Explanation

Cisco Secure Firewall Security Intelligence can block connections to known-bad IP addresses and includes a command-and-control (CnC) intelligence category. Allowing DNS traffic only to approved, trusted DNS destinations prevents internal endpoints from sending DNS traffic to arbitrary external hosts, reducing the opportunity for DNS tunneling and similar C2 communications.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!