Which Correlation Policy Event Type Uses an External Dynamic List?
An engineer must configure a correlation policy in Cisco Secure Firewall Management Center to detect when an IP address from an internal network communicates with a known malicious host. Connections made by the internal IP addresses must be tracked, and an external dynamic list must be used for the condition. Which type of event must the engineer configure on the correlation policy?
Community Insight
The question tests which correlation-rule event type is driven by per-connection data matched against an external dynamic list, and the trap is assuming that any condition involving a "malicious host" automatically maps to malware or intrusion events.
In Cisco Secure Firewall Management Center, a correlation policy spots internal hosts talking to known-bad destinations by using connection tracker events whose conditions reference an external dynamic list. This page explains why connection tracker (B) — not malware, intrusion impact alert, or network discovery events — is the event type the engineer must configure.
Choosing malware (C) simply because the destination is described as a "known malicious host"; malware events require a file or AMP/cloud verdict on a file, and they never evaluate IP-based connection tracking against an external dynamic list.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Correlation policies in Secure Firewall Management Center build correlation rules from a defined set of event types: intrusion, malware, discovery, and connection tracker. The scenario is explicitly about monitoring the connections that internal IP addresses make toward destinations held on an external dynamic list, which is connection-oriented data rather than a signature hit, a file verdict, or a discovered host record. Connection tracker events are the only option that watches connection data (source/destination IP, ports, and related traffic attributes), so the external dynamic list can be referenced as the condition that flags traffic to known malicious hosts. The requirement that "connections made by the internal IP addresses must be tracked" points directly at connection tracker, making B the answer the scenario describes.Why the Other Options Are Wrong
Intrusion Impact Alert (A) is a variant of intrusion event handling driven by an IPS signature firing and its impact flag/level — nothing in the scenario mentions an exploit signature or impact assessment, and an EDL destination alone does not generate an intrusion impact alert. Malware (C) events require file inspection and an AMP/cloud verdict on files traversing the device; the question never mentions file transfer or file policy, only IP-to-IP communication with a listed malicious host. Network discovery (D) events describe hosts, applications, and protocols learned by the discovery mechanisms (for example NetFlow or passive interfaces), which produces host profiles but does not evaluate whether a specific connection matches a threat list. Only connection tracker ties connection-level tracking to an external dynamic list condition.Community Comment Notes
The single recorded comment, from donciga, selects answer B and links Cisco's correlation policy documentation, which mirrors the event taxonomy used above rather than contradicting it. No commenter argued for malware, intrusion impact alert, or network discovery, and the community pick aligns with the documented behavior of correlation rules. Because the vote tally on that comment is minimal, it should be treated as corroboration of the reasoning, not as proof on its own. The decisive factor remains the wording of the question itself, which asks for tracked connections plus an external dynamic list condition.Exam Strategy
When a correlation-policy question mentions tracking connections, hosts, or traffic against a list (EDL, Security Intelligence, or network object), anchor on connection tracker events and eliminate any option tied to file verdicts or IPS signatures. Read for the data source the rule consumes — connections, files, signatures, or discovery records — before matching it to the condition described.Official Reference
Exam Strategy
Correlation-policy items are almost always solved by identifying the data source the rule consumes: connections, files, IPS signatures, or discovery records. If the condition is an external dynamic list applied to tracked connections, connection tracker is the event type to select; malware and intrusion options only apply when a file verdict or a signature is genuinely involved.
Frequently Asked Questions
Why isn't a malware event the right choice for this correlation rule?
Malware events are generated from file inspection and AMP/cloud verdicts. Nothing in the scenario involves file transfers, so a malware event cannot match internal IP connections to an EDL-listed host.
How does the external dynamic list fit into a connection tracker correlation rule?
The EDL supplies the set of known malicious destinations that the connection tracker conditions compare against, so only tracked connections to those listed addresses satisfy the rule.