An e-commerce firm ingests daily feeds of hostile IPs, URLs and DNS names and wants every entry stopped before any access control rule is evaluated. Its partner's storefront sits behind changing cloud addresses, so the exception must match on the domain. Which Security Intelligence design should the team deploy?
Select an answer to reveal the explanation.
Short Explanation
Load the hostile feeds as Security Intelligence lists and enable them in your access control policy, so they’re checked before any access control rule. Add the partner domain to Do Not Block so the exception still matches as its cloud addresses change. It’s like checking a guest list at the door, not passing a note to the seating committee.
Full Explanation
Security Intelligence is the first phase of access control: it matches connections against IP, URL and domain entries and drops them before the ordered access control rules are ever evaluated, so a later rule edit can never quietly reallow a listed host. Loading all three feeds as Security Intelligence lists with the partner domain on the Do Not Block list satisfies coverage, ordering and the exception in one place, because Do Not Block exempts that entry and sends its traffic down the normal policy path. A DNS policy rule fails the coverage requirement, since DNS rules only match the requested domain name and never see a direct IP connection or a plain HTTP request. Blocking the feeds from the top of the access control policy fails the ordering requirement, because that block still lives inside the policy instead of ahead of it. Matching the partner's server IP fails the exception requirement, because cloud addresses rotate and the exemption silently expires. The exam caveat is that list changes take effect only after you deploy the policy to the sensor. As a practical check, watch the Security Intelligence events view while probing one listed address and one partner domain to confirm both the block and the exception.