5.4.a Threat defense
Aligned to Cisco's 350-401 ENCOR v1.2 exam topics.
On this page
What this objective tests
This is a describe objective. The exam wants you to name the threat defense components and explain what each one detects or blocks. Threat defense is not one device. It is prevention, detection, containment, and response working together.
The three inspection components
| Component | What it does | Mode |
|---|---|---|
| Intrusion Detection System (IDS) | Watches traffic and raises alerts | Passive. Does not block. |
| Intrusion Prevention System (IPS) | Watches traffic and blocks matches | Inline. Can drop traffic. |
| Malware protection | Inspects files and endpoints for malicious code | Blocks or quarantines |
| URL filtering | Allows or denies web requests by category and reputation | Blocks at request time |
The key difference is action. An IDS alerts after the fact. An IPS sits in the traffic path and stops the attack.
Where the data comes from
Threat defense works from telemetry:
- Firewall and IPS events.
- Flow records such as NetFlow.
- DNS and web logs.
- Endpoint detection events.
- Authentication logs.
- Device syslog.
A log is useful only with identity, time, and context. An IP address alone is weak evidence.
Example: contain a compromised host
A user PC normally reaches web and internal apps. It starts scanning servers and trying SSH. A layered design responds like this:
- Flow telemetry detects unusual east-west scanning.
- Endpoint detection flags the host behavior.
- The identity system maps the IP address to a user and device.
- Network access control changes the endpoint authorization.
- The switch moves the endpoint to a quarantine VLAN.
- Firewall policy limits the endpoint to remediation servers only.
The exam skill is to see how the pieces work together. Detection finds the host. Segmentation contains it. Response cleans it.
Exam traps
- IDS detects and alerts. IPS detects and blocks. Do not mix them.
- Threat defense is not only prevention. Detection and response matter.
- Segmentation limits the damage after prevention fails.
- Malware protection and URL filtering answer different questions: file versus destination.
Pass check
You are ready for this objective when you can do these things:
- Explain the difference between IDS and IPS in one sentence.
- Name what malware protection and URL filtering each inspect.
- List three telemetry sources for threat detection.
- Walk through the six containment steps for a compromised host.