A network host is infected with malware by an attacker who uses the host to make calls for files and shuttle traffic to bots.
This attack went undetected and resulted in a significant loss.
The organization wants to ensure this does not happen in the future and needs a security solution that will generate alerts when command and control communication from an infected device is detected.
Which network security solution should be recommended?
Click on the arrows to vote for the correct answer
A. B. C. D.B.
Option B, Cisco Secure Firewall Threat Defense (Firepower), would be the recommended network security solution for detecting command and control communication from an infected device.
Cisco Secure Firewall Threat Defense (Firepower) is a next-generation firewall that provides advanced threat protection, including intrusion prevention, malware protection, and URL filtering. It uses machine learning to analyze network traffic and detect anomalies that may indicate an ongoing attack. Firepower is also integrated with Cisco Talos, a threat intelligence service that provides real-time updates on emerging threats.
In the case of the infected device making calls for files and shuttle traffic to bots, Firepower's intrusion prevention system would detect and block the malicious traffic. Firepower's URL filtering feature would also prevent the device from accessing known malicious sites. Additionally, Firepower's advanced malware protection would detect and block any attempts to download or execute malware on the infected device.
Furthermore, Firepower has the capability to generate alerts when it detects command and control communication from an infected device. Command and control communication is a critical component of many cyber attacks, as it allows the attacker to remotely control the infected device and exfiltrate sensitive data. By detecting and blocking command and control communication, Firepower can significantly reduce the risk of a successful cyber attack.
In summary, Cisco Secure Firewall Threat Defense (Firepower) is a comprehensive network security solution that provides advanced threat protection, including intrusion prevention, malware protection, URL filtering, and the ability to generate alerts when it detects command and control communication from an infected device. Therefore, it would be the recommended security solution for the organization in question.