A bank's analysts find that some staff machines resolve freshly registered malware domains and then connect straight to the IP addresses, sidestepping domain controls. The team must answer malicious DNS queries with a sinkhole from the firewall, drop known-bad IP ranges before access control rules are evaluated, and keep legitimate subdomains of the same zones resolving normally. Which DNS and Security Intelligence design meets all three requirements?
Select an answer to reveal the explanation.
Short Explanation
You’ll sinkhole only the listed malicious hostnames in DNS policy, so legitimate subdomains can still resolve normally. Add the bad IP ranges to Security Intelligence to drop direct connections before access control rules are checked—like stopping a package at the gate.
Full Explanation
Use a DNS policy sinkhole action for the listed malicious hostnames. That action returns the configured sinkhole address for matching DNS queries, while names that do not match continue to resolve normally. Security Intelligence can block known-bad IP addresses or ranges before access control policy evaluation, so it can also stop direct-IP connections that do not involve a DNS query. An access control rule may block those addresses, but it does not meet the requirement to drop them before access control rules are evaluated. Dropping DNS queries does not answer them with a sinkhole address. Sinkholing entire parent domains would also affect legitimate names beneath those domains. Practical check: query a listed hostname and confirm that the response contains the configured sinkhole address.