Chapter 13. Domain Name System (DNS) Policy

Question 1

1. Which of the following actions can detect a harmful domain without interrupting traffic flow?

A. Domain Not Found

B. Do-Not-Block List

C. Block List

D. Monitor

Answer 1

D. The monitor action allows a packet to go through a threat defense; however, it can log the packet transfer as an event.

Question 2

2. Which of the following actions sends an address of a spoofed DNS server?

A. Domain Not Found

B. Sinkhole

C. Monitor

D. Drop

Answer 2

B. A sinkhole is configured to respond with a spoofed DNS server address.

Question 3

3. Which of the following statements is incorrect?

A. Sinkhole configuration requires a unique type of sinkhole object.

B. A DNS policy requires a threat license.

C. A threat defense downloads the latest Cisco intelligence feed directly from the Cisco cloud.

D. The management center supports the blocking of custom domain lists.

Answer 3

C. A threat defense does not download the intelligence feed; the management center downloads the feed and deploys it to its managed threat defense devices.

Question 4

4. Which of the following options can expedite the enforcement of a new DNS policy?

A. Clearing the DNS cache of the client and server manually.

B. Disabling the DNS caching on the local workstations by the system administrator.

C. Positioning a threat defense between the local-area network (LAN) and the DNS server.

D. All of these answers are correct.

Answer 4

D. All of these answers are correct. These options can help expedite the enforcement of a new DNS policy.

Question 5

5. Which license is necessary to configure and deploy a DNS policy on Secure Firewall?

A. Threat license

B. Malware license

C. DNS license

D. No additional license is necessary. This is a basic firewall functionality; you can enable a DNS policy out of the box.

Answer 5

A. A threat license is required.

Question 6

6. Which of the following statements is true about a DNS policy?

A. A new DNS policy comes with two built-in rules: Global Do-Not-Block List for DNS and Global Block List for DNS.

B. The default DNS policy is modifiable but not removable.

C. A DNS policy needs to be invoked within an access control policy to activate it on a threat defense.

D. All of these answers are correct.

Answer 6

D. All of these answers are correct. They are true for a DNS policy.

Question 7

7. Which of the following directories stores the files related to a DNS policy?

A. /var/sf/sidns_intelligence

B. /var/sf/sidns_download

C. /var/log/sidns_policy

D. /var/log/sidns_list

Answer 7

B. The DNS policy-related configurations are stored at /var/sf/sidns_download.