What method blocks a malicious IP address from C2 traffic without needing firewall configuration changes?

What method blocks a malicious IP address from C2 traffic without needing firewall configuration changes?

• A. Add the IP address to a deny rule in the firewall
• B. Add the IP address to a TIM malicious IP list to evaluate future alert priority
• C. Add the IP address to an external dynamic list (EDL) used by the firewall
• D. Create a NetOps ticket for a firewall configuration change to block the IP

Answer: (C)

The method that effectively blocks a malicious IP address from command-and-control (C2) traffic without requiring changes to the firewall configuration is to add the IP address to an external dynamic list (EDL) used by the firewall. An EDL allows security devices to quickly adapt to new threats by referencing an up-to-date list of malicious IPs that can be maintained externally. This integration helps in automating responses to threats, enabling real-time updates to security policies and making the management of security measures more efficient. Using an EDL means that administrators can dynamically block or allow traffic based on current threat intelligence without the need to manually modify the firewall settings each time an IP is identified as malicious. This proactive stance enhances the network's security posture against C2 activities while also saving time and reducing the risk of human error that often accompanies manual configuration changes.

The method that effectively blocks a malicious IP address from command-and-control (C2) traffic without requiring changes to the firewall configuration is to add the IP address to an external dynamic list (EDL) used by the firewall. An EDL allows security devices to quickly adapt to new threats by referencing an up-to-date list of malicious IPs that can be maintained externally. This integration helps in automating responses to threats, enabling real-time updates to security policies and making the management of security measures more efficient.

Using an EDL means that administrators can dynamically block or allow traffic based on current threat intelligence without the need to manually modify the firewall settings each time an IP is identified as malicious. This proactive stance enhances the network's security posture against C2 activities while also saving time and reducing the risk of human error that often accompanies manual configuration changes.