Cisco CCNP Security Core (SCOR) 350-701Content SecurityHard
A security analyst is investigating a potential data exfiltration attempt where sensitive corporate documents were reportedly uploaded to an unsanctioned cloud storage service. The organization uses Cisco Firepower Threat Defense (FTD) appliances with a Firepower Management Center (FMC). Which FMC feature provides the most effective way to identify and block the specific content of these documents from leaving the network, regardless of the application or protocol used?
- AIntrusion Policy with Snort rules
- BAccess Control Policy with URL filtering
- CFile Policy with Malware Cloud Lookup
- DDLP Policy with custom sensitive data classifiers
Show answer & explanationAnswer & explanation
Correct answer: D. DLP Policy with custom sensitive data classifiers
Data Loss Prevention (DLP) Policies, especially when configured with custom sensitive data classifiers, are designed to identify and prevent the exfiltration of specific content (like corporate documents) from the network. Unlike other features that focus on applications, URLs, or malware, DLP directly inspects the data payload for predefined patterns or characteristics of sensitive information.
Why the other options are wrong
- A. Intrusion Policies with Snort rules focus on detecting and blocking attack patterns, not specific sensitive document content.
- B. Access Control Policies with URL filtering block access to entire sites/categories, not specific content within uploads, and cannot identify sensitive data.
- C. File Policies with Malware Cloud Lookup identify and block malicious files, not sensitive, legitimate documents.
FTD DLP Policies
Cisco Firepower Threat Defense (FTD) Data Loss Prevention (DLP) policies are used to inspect network traffic for sensitive data and prevent its unauthorized exfiltration, often leveraging custom classifiers.
- Inspects data payload for sensitive information.
- Uses predefined or custom classifiers (e.g., regex, file properties).
- Can block, log, or alert on sensitive data exfiltration.
Memory trick: DLP is the watchful librarian for your digital secrets.