350-701 Question 106

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  The answer is B, take in consideration that firepower is going to block the malicious traffic when the session is established. With Umbrella, what is going to happen is that when the DNS request is done for that particular domain, before any kind of TCP session is going to be established, is going to verify the reputation of that domain. If the domain is a gray domain, the Intelligent Proxy will be used. If there is SSL Decryption configured with the Intelligent Proxy, the Intelligent Proxy is going to negotiate the TLS connection to the destination server. Is going to act as a man in the middle, if the server is going to send any kind of malicious data, like a malicous file, Umbrella detect that, and the connection will be closed.

• 1

  Of course if the domain have a bad reputation, the DNS request will be blocked, and you will be the Umbrella web page when you are trying to contact that domain. So in this case you are not going to establish any kind of connection to the malicious servers.

• Chose A1

  For the yr 2026, this is a very complicate question as now Cisco Umbrella is evolving to Cisco Secure Access which has a lot of security features (some as add-ons). Looking at this question in the simpler way, I think that Cisco FPR is the right answer as it can be deployed as well for traffic within the network at Layer 2. Using app control, url filtering/reputation and geoip fencing, FPR can block a connection before that being established either on IP or FQDN as well as control the traffic within the network. I will go with A for the above reasons