Question

A security engineer configures a Cisco Secure Firewall Threat Defense device to automatically download and enforce a Cisco Talos-provided list of known malicious IP addresses so that outbound connections to those hosts are dropped before deep inspection occurs. Which security intelligence function does this configuration primarily represent?

Accepted Answer

Consuming an externally sourced intelligence feed to enforce reputation-based blocking early in the processing path

Answer

Authoring custom intelligence by manually curating indicators of compromise for internal distribution

Answer

Sharing locally observed threat data with upstream community partners via a publish subscribe model

Answer

Performing signature-based intrusion prevention using Snort rules against inspected packet payloads