Your SOC must stop users from reaching known malicious domains befo…

Question

Your SOC must stop users from reaching known malicious domains before a web request is sent, while also allowing inspection and policy enforcement for specific outbound URLs. Which architecture best matches these requirements?

Accepted Answer

Deploy DNS filtering to block resolution of known malicious domains and a forward proxy to inspect and control outbound HTTP requests by URL. — Think of DNS filtering as stopping a car before it leaves the garage by refusing the address lookup; the forward proxy is the toll booth that can read the destination URL and apply rules. If you swap them, you're trying to inspect HTTP with a phone book and block domains with a web proxy. Match the control to the layer: domain before resolution, URL inside the request.

Answer

Use an endpoint firewall to block known malicious domains and outbound HTTP requests by URL before DNS resolution.

Answer

Use DNS filtering to inspect outbound HTTP requests by URL and a forward proxy to block known malicious domains.

Answer

Use a forward proxy to block known malicious domains and DNS filtering to inspect outbound HTTP requests by URL.

Your SOC must stop users from reaching known malicious domains before a web request is sent, while also allowing inspection and policy enforcement for specific outbound URLs. Which architecture best matches these requirements?

Short Explanation

Full Explanation