Free Cisco 300-710 Actual Exam Questions - Question 15 Discussion
administrator is trying to correlate malicious activity with a user Which widget should be configured
to provide this visibility on the Cisco Firepower dashboards?
C shows real-time user sessions, so it helps link malicious activity quickly.
A/D? Custom Analysis might let you tailor the view exactly how you want for user correlation, while Correlation Events sounds like it automatically links suspicious activity with users. Both could work depending on setup.
It’s C too since Current Sessions lets you see live user activity tied to network traffic.
Makes sense that it’s about linking events, so D is good, but I’d say A could work too since Custom Analysis lets you build specific views. Still, D fits better for automatic correlation. D
Maybe C, since Current Sessions could show who's active during suspicious events.
It’s D for sure. Correlation Events are made to link multiple data points, like user info and malicious activity, which is exactly what the question asks for. The other options either show raw data (Current Sessions) or general status (Current Status), but they don’t specifically connect events to users. Custom Analysis sounds useful but is more about custom reports, not real-time or clear correlation. So D nails the purpose better here.
A/C? Custom Analysis might let you tailor reports to link users and threats, but Current Sessions could also show live user activity that matches suspicious behavior. Not totally clear which fits better here.
Option D seems like the best fit since correlation usually involves linking different events or data points, which would help connect malicious activity to a user. But the question doesn’t specify what version of Firepower is being used or if any custom configurations are already in place. Anyone know if different versions have different dashboard widgets or if certain features need to be enabled first? That might affect which option actually works here.