Cisco 300-740 Online Access

Rule 3 allows all traffic (including SSH) from 10.1.0.0/30 during the hours of 18:00–08:00, which directly conflicts with Rule 1 that is intended to deny SSH at those same hours. Since firewall rules are evaluated top-down and Rule 3 allows traffic during the exact period where SSH should be blocked, deleting Rule 3 will allow Rule 1 to apply correctly.

This behavior is explained in SCAZT Section 3 (Network and Cloud Security, Pages 72–75), where rule precedence and time-based evaluation logic are discussed.

According to the SCAZT guide, the “Always-on” deployment mode for Cisco Secure DDoS (including integration with Secure Web Application Firewall solutions) provides continuous protection for both volumetric and application-layer attacks. This deployment model ensures that all traffic flows through the scrubbing and WAF infrastructure without requiring traffic redirection only during attack events. It provides real-time mitigation and immediate detection, which is essential to address both volumetric attacks (e.g., SYN floods) and Layer 7 (application-layer) attacks such as HTTP floods and injection-based threats.

While “Hybrid” and “On-demand” modes are useful for specific use cases, only “Always-on” offers continuous and comprehensive protection required for environments that demand consistent uptime and threat prevention.

Web Application Firewalls (WAFs) use rate-based rules as one of the primary mechanisms to detect and mitigate Distributed Denial of Service (DDoS) attacks. According to the SCAZT Study Guide, Section 3 (Network and Cloud Security, Pages 74–77), rate-based rules dynamically detect unusual spikes in traffic and can throttle or block connections exceeding predefined thresholds. This form of protection is more adaptive and intelligent than standard ACLs or static filtering, enabling protection against zero-day and volumetric attacks that may not follow known patterns.

The Remote Desktop Protocol (RDP) uses TCP port 3389. Cisco Umbrella includes a cloud-delivered firewall that can be used to block outbound traffic by port. In this case, since the RDP communication needs to be prevented regardless of application name resolution, the best approach is to use a Firewall policy in Umbrella to block port 3389 traffic across the tunnel.