Which FMC Risk Report Shows Total Attacks and CnC Hosts?

Why the Answer Is Correct

The four fields listed — Total Attacks, Events Requiring Attention, Hosts Targeted, and Hosts Connected to CnC Servers — are the signature headers of the Attacks risk report in Cisco Secure Firewall Management Center. That report is deliberately attack-centric: it rolls up how many attacks occurred, which of those events demand analyst attention, how many victim hosts were touched, and how many hosts are beaconing to command-and-control infrastructure. Every one of those metrics is expressed in terms of an attack relationship between an attacker and a target, which is exactly what the Attacks risk report is built to summarize. Community consensus matches this: CrashRTX states, "generating the attacks report in FMC lists all those titles as headers," and donciga points to the same conclusion using Cisco's FMC administration documentation on reports. Choosing A also fits exam doctrine, where report-type questions are answered by matching the report's subject noun (attacks) to the dominant entity in the field list (attacks and the hosts they touched).

Why the Other Options Are Wrong

The network risk report (B) is built around network-level visibility — discovered subnets, protocols, and traffic relationships — not attack counts or CnC connections, so the Total Attacks header would be out of place there. The events risk report (C) is tempting only because of the phrase "Events Requiring Attention," but an events report profiles event volume and severity by event type from connection, intrusion, malware, and discovery data rather than framing everything as attacker-versus-target. The hosts risk report (D) is the strongest distractor because two fields mention hosts, but host risk reporting is organized around individual host profiles, host attributes, and per-host risk scores, and it does not lead with a Total Attacks header. In other words, options C and D describe reports that consume attack data, while A is the report whose identity is defined by that attack data — the field list is a package deal, and only one report carries all four headers.

Community Comment Notes

Both visible comments converge on the same letter, and neither relies on vote count alone. CrashRTX explains the practical reason — when he generates the attacks report in FMC the same labels reappear as column headers, which is the kind of first-hand GUI evidence that settles report-identification questions. donciga anchors the answer in official material, citing Cisco's Secure Firewall Management Center administration guide page on reports as the source for the field names. Taken together, the comments confirm that the deciding factor is the exact header wording rather than the presence of the word "Hosts," which is precisely the distinction a careless reader misses.

Exam Strategy Tip

When a question lists report fields, silently classify each field by its subject: attack, host, event, or network. Whichever subject dominates the list wins the answer — here three of four fields describe attack relationships, so attacks (A) is the only defensible choice.