Cisco 300-740 Exam With Confidence Using Practice Dumps

From the firewall access rules provided, Rule 1 allows traffic from 20.1.1.10 (GCP VM) to 20.1.1.1 using HTTPS. However, this destination is not the actual mail server—the mail server resides at 192.168.200.10 (inside network). Therefore:

A: Rule 1 must be updated to reflect the correct destination: 192.168.200.10. Without this change, traffic is not permitted to the mail server.

D: NAT (Network Address Translation) is needed to translate the external address (e.g., 20.1.1.10) to access internal addresses (like 192.168.200.10). As per SCAZT and Cisco firewall policies, NAT enables proper packet delivery from public to private zones.

Rule 2, which denies all other traffic, is correctly placed after the specific allow rule. Therefore, moving it (Option B) would not help, and Options C and E are unrelated to resolving the immediate firewall access and routing issue.

Rule 3 allows all traffic (including SSH) from 10.1.0.0/30 during the hours of 18:00–08:00, which directly conflicts with Rule 1 that is intended to deny SSH at those same hours. Since firewall rules are evaluated top-down and Rule 3 allows traffic during the exact period where SSH should be blocked, deleting Rule 3 will allow Rule 1 to apply correctly.

This behavior is explained in SCAZT Section 3 (Network and Cloud Security, Pages 72–75), where rule precedence and time-based evaluation logic are discussed.

The Secure Cloud Analytics alert indicates suspicious heartbeat-based connections from an internal server (ip-10-201-0-16) to multiple suspicious IPs over UDP/port 53 (DNS). This behavior suggests command-and-control (C2) activity or botnet communications.

B: Alerting the incident response (IR) team is a critical next step in escalating a verified threat as per SCAZT Section 6 (Threat Response, Pages 114–117).

D: Blocking the identified malicious IPs on perimeter firewalls or network access control devices is an appropriate containment step to disrupt communication.

Reinstallation (A/E) is premature without a full forensic investigation. Validating IDS logs (C) is useful but not immediate response-focused compared to actions B and D.