Cisco Umbrella DNS-Layer Security for Pre-Connection Blocking
Describe the controls used to protect against phishing and social engineering attacks
Answer
Correct answer: B — Cisco Umbrella uses DNS-layer security to block malicious destinations and applications before a connection is established.
An organization is trying to improve their Defense in Depth by blocking malicious destinations prior to a connection being established. The solution must be able to block certain applications from being used within the network. Which product should be used to accomplish this goal?
Community Insight
The key trap is confusing traditional firewall application control with DNS-layer security; only Umbrella blocks requests at the DNS resolution phase, effectively preventing the connection from ever being established.
This question tests the capability of Cisco Umbrella to block malicious destinations prior to connection establishment using DNS-layer security. It establishes that Umbrella is the correct choice for blocking applications within a network before connections are made.
Many candidates choose Cisco Firepower (A) because it has Application Control (AVC), but Firepower inspects traffic after the TCP handshake begins, meaning the connection is already partially established.
Community Discussion (62 comments)
XBfoundX
👍 1
Selected: B
The answer is B, take in consideration that firepower is going to block the malicious traffic when the session is established. With Umbrella, what is going to happen is that when the DNS request is done for that particular domain, before any kind of TCP session is going to be established, is going to verify the reputation of that domain. If the domain is a gray domain, the Intelligent Proxy will be used. If there is SSL Decryption configured with the Intelligent Proxy, the Intelligent Proxy is going to negotiate the TLS connection to the destination server. Is going to act as a man in the middle, if the server is going to send any kind of malicious data, like a malicous file, Umbrella detect that, and the connection will be closed.
XBfoundX
👍 1
Of course if the domain have a bad reputation, the DNS request will be blocked, and you will be the Umbrella web page when you are trying to contact that domain. So in this case you are not going to establish any kind of connection to the malicious servers.
Silexis
👍 1
Selected: A
For the yr 2026, this is a very complicate question as now Cisco Umbrella is evolving to Cisco Secure Access which has a lot of security features (some as add-ons). Looking at this question in the simpler way, I think that Cisco FPR is the right answer as it can be deployed as well for traffic within the network at Layer 2. Using app control, url filtering/reputation and geoip fencing, FPR can block a connection before that being established either on IP or FQDN as well as control the traffic within the network. I will go with A for the above reasons
Rakinor
👍 1
Selected: D
Blocking the Application. Not the DNS Query, so i would go for AMP
ITPro21
👍 1
Selected: B
Acts as a first line of defense, blocking threats before they reach the network or endpoints.
kloug
👍 1
Answer b
Premium_Pils
👍 1
Block from being used within the network... So, the application could reside on the internet, but being inaccessible in the organisation network. I think, it is what umbrella does.
luismg
👍 1
Selected: D
I would say is D Umbrella cannot stop ip connections firepower just traffic that goes through it. amp is host ralated, it can block any connection
Premium_Pils
👍 1
Selected: B
Block the process right at the beginning, i.e. at the DNS request step, before making a connection to the bad website. - B
Premium_Pils
👍 1
https://umbrella.cisco.com/products/sig-product The question would fit for umbrella, except that it is about blocking access within the network. (However, they did not specify which network.) Did someone find a relevant documentation about AMP?
4pelos
👍 2
Correct answer B. Checked in securitytut
xziomal9
👍 1
Answer B
jorg32
👍 1
Selected: B
Umbrella, is trying to block the start of the conversation with bad websites, why block the application when you know you can block way earlier on the traffic flow?
Jessie45785
👍 2
Selected: D
The solution must be able to block certain applications from being used within the network I really think it is D cause: - NGFW cannot stop it in L2 - Umbrella can block only DNS protocol - what about all the other ones - wont be able to detect it - WSA - proxy will definitely will not help here ... but AMP can block application from being able to start hence cutting it from TCP stack and fulfilling a requirement of "blocking malicious destinations prior to a connection being established" but it is Cisco so you never know :/
F0rtyx40
👍 1
It's B, Umbrella can block the connection before firepower L7 application detectors kick in.
gc999
👍 1
I think most of us already get the keywords here "prior to a connection being established" and "within the network". Can I make an example that if there are two internal users, let say User-1 and User-2, within the network, which solution can block the certain application being send from User-1 to User-2?
SegaMasterSystemAdmin
👍 1
This is a tricky one, the question is weird because the keywords are "prior to a connection being established" and "must be able to block certain applications". It is true that Umbrella blocks the DNS traffic so that it does that take care of "prior to a connection being established". However, Umbrella does not block the application itself just the DNS traffic, so if the application does not utilize DNS and is IP based, it will not block anything, Firepower on the other hand can block the applications and with a "Block with Reset" it does not allow any connection to be established. Also, both can block based on malicious destination. I will still go with B though.
KPzee
👍 1
A is correct a firewall will block certain applications that might already be on the network.
Toni_Su91
👍 2
Prior to a connection being established - This is classic Umbrella - DNS security is first line of defence.
sull3y
👍 3
The answer is B. Cisco Umbrella. Cisco Umbrella is a cloud-based security solution that provides advanced threat protection and blocks malicious destinations before a connection is established. It uses DNS-layer security to block requests to known malicious domains and IPs, and it also has the capability to block certain applications from being used within the network. By implementing Cisco Umbrella, the organization can improve their defense in depth by preventing malicious traffic from entering the network, thus reducing the risk of a successful cyber attack.
psuoh
👍 2
I think A is the Cisco's correct answer. the question asks "within the network". Umbrella would do on and off the network/app blocking. Similarily, firepower can do network/app block for the network. Umbrella would be a overkill for a "organization". https://community.cisco.com/t5/network-security/firepower-or-umbrella-for-blocking-urls-applications-ip/td-p/4430076
ureis
👍 5
I managing a Umbrella of our costumer and this is what Umbrella is showing to us when i go to "DNS POLICIES": "Control Applications - Select applications or application categories you'd like to block or Allow for the users in your organization" In other hand you can do the same on Firepower ACP blocking applications. Maybe the magic word here be: "prior to a connection being established" I'll choose B
Emlia1
👍 2
Selected: B
It's B
west33637
👍 7
Selected: B
B is correct. AVC on Firepower can not block applications from being used 'within the network'. Firepower can only block these applications if they pass through the firewall. Umbrella can block connections to malicious sites before the connection is made based on the DNS lookup. Umbrella also installs an endpoint supplicant or can be used as an Anyconnect module. This way you can push an application policy to the endpoints blocking even applications 'within the network'. Same as aalnman, I have used this at work and at home.
royallyre20
👍 2
Selected: A
Umbrella can block destination depending on DNS and cannot block application. Firepower can block destination and application using application control function.
ureis
👍 1
Firepower is the only with LINA processor that can drop any packets before foward to Snort
sis_net_sec
👍 2
Selected: B
https://www.cisco.com/c/m/en_il/training-events/experience-it-umbrella/index.html Cisco Umbrella uses the internet’s infrastructure to block malicious destinations before a connection is ever established. Umbrella uses DNS to stop threats over all ports and protocols — even direct-to-IP connections. Stop malware before it reaches your endpoints or network.
NikoNiko
👍 1
Correction: "blocking malicious destinations prior to a connection being established" - but still you are not tasked by blocking source application which is making connections to specific destinations.
nomanlands
👍 4
Selected: D
The key here is "within the network". Umbrella will block DNS if the application is using DNS, Firepower can block things leaving the network, but not things within a network. Therefore, it would be EDR software.
Thusi26
👍 1
"prior to a connection being established", means before a connection being made. This is achievable by simply adding Firewall rules based om applications / destinations.
Pwned
👍 3
Selected: B
Cisco Umbrella is the correct answer
TesterDude
👍 3
Selected: D
I'm going with D here because it specifically states blocking the APPLICATION before connection is established, which is done with AMP for Endpoints Application Control: AMP for Endpoints Application Control: Like files, applications can be detected, blocked, and whitelisted. As with the other files, AMP does not look for the name of the application but the SHA-256 hash. Santos, Omar. CCNP and CCIE Security Core SCOR 350-701 Official Cert Guide (p. 644). Pearson Education. Kindle Edition.
NikoNiko
👍 1
Totally wrong, question requires blocking of CONNECTIONS, not entire applications running on corporate devices.
otzu1
👍 1
thinking about it now, within the network maybe a dead giveaway, i'm guessing that's firepower/
otzu1
👍 1
I think it's Umbrella, bc it states in the question "prior to a connection being established" however, it doesn't state to where the connection. I was thinking about the source, but then i thought well maybe the firepower will challenge the request, but then i thought perhaps to org doesn't even want the connection to be established to the firepower.
Sparrsh
👍 3
Answer is B,, because Cisco Umbrella uses the internet's infrastructure to block malicious destinations before a connection is ever established. https://www.cisco.com/c/m/en_il/training-events/experience-it-umbrella/index.html#:~:text=Cisco%20Umbrella%20uses%20the%20internet's,reaches%20your%20endpoints%20or%20network.&text=Register%20now%20to%20secure%20your%20spot!
dr4gn00t
👍 2
Once again question with multiple valid answers. We just have see what is the exact wording in test and hopefully that will make it easier to choose between A, B or D..
SegaMasterSystemAdmin
👍 2
Selected: A
Its not Umbrella, Umbrella cannot block certain applications, so has to be Firepower.
batoussai
👍 3
B-Umbrella can block apps as well, next to block destinations before a connection: https://docs.umbrella.com/umbrella-user-guide/docs/advanced-app-controls
coentror
👍 3
It is B - Umbrella: https://www.cisco.com/c/m/en_il/training-events/experience-it-umbrella/index.html "Cisco Umbrella uses the internet’s infrastructure to block malicious destinations before a connection is ever established. Umbrella uses DNS to stop threats over all ports and protocols — even direct-to-IP connections. Stop malware before it reaches your endpoints or network."
manhatar
👍 5
I was going with several people here : Umbrella. But after reading jaciro, I agree with firepower. Indeed Umbrella can block before the connection has established. Indeed firepower has to let pass some packets before application recognition (so before the connection has established doesn't work). BUT here we are saying :"blocking malicious destinations prior to a connection being established" and don't forget that in DAQ we have Security Intelligence able to block before the connection has establish for IP Blacklist AND URL blacklist. Si for me firepower can block before a connection with SI.
jaciro11
👍 3
All the people here told Umbrella: But the question is tricky. They ask about a connection. If I want to block a destination and If this destinations is an IP through Umbrella this is not possible, but thought firepower it is possible, also they dont ask about domains, they speak about possible destinations (Domains and IPs). Thats why I think the correct answer is A Again people, remember firepower can block and the beginning of the connection or at the end. Also block malware, malicious domains, Block Apps and more efficient than umbrella. The only improvement in umbrella is detect malicious destinations thought DNS and the easy deployment vs firepower.
jaciro11
👍 4
The answer is Umbrella: By enforcing security at the DNS and IP layers, Umbrella blocks requests to malware, ransomware, phishing, and botnets before a connection is even established — stopping threats over any port or protocol before they reach your network or endpoints. Umbrella provides coverage for all connected devices – including roaming laptops, Android and iOS devices, and delivers great time-to-value. The same apply to APPs. https://umbrella.cisco.com/why-umbrella/top-reasons-to-trial
kapplejacks
👍 1
improve their Defense in Depth by blocking malicious destinations prior to a connection being established. solution must be able to block certain applications from being used within the network. Does not state how we are blocking the applications but the first sentences "blocking malicious destinations prior to a connection being established" would be some kind of DNS based lookup. If it stated "blocking malicious applications prior to a connection..." its AMP. Answer is B Umbrella provides Defense in Depth by blocking malicious destinations that applications could connect to before they are able to initialize the communication.
Sarbi
👍 1
I am 100 % sure the answer is A.Cisco Umberlla.
denverfly
👍 1
may be Cisco Firepower
klu16
👍 3
I'm going with B - Cisco Umbrella. "By enforcing security at the DNS and IP layers, Umbrella blocks requests to malware, ransomware, phishing, and botnets BEFORE A CONNECTION IS EVEN ESTABLISHED — stopping threats over any port or protocol before they reach your network or endpoints. Umbrella provides coverage for all connected devices – including roaming laptops, Android and iOS devices, and delivers great time-to-value."
kerniger
👍 1
Firepower is not able to block applications WITHIN the network. the only one who can do this seems to be D - Cisco AMP
AS04
👍 7
A is correct, Firepower has AVC feature that can block traffic based on application.
Reece_S
👍 3
I'm going with A only because the question stated improving their Defense in Depth which works by placing multiple layers of defense on the network to create a series of overlapping and redundant defenses. Firepower has integrations with Umbrella and AMP. So if they both fail at blocking the destination and running the application, Firepower can still do it.
zap_pap
👍 3
Ridiculous question. Umbrella uses DNS for decision making, what if applications is using direct IP connection? Umbrella will not stop it. It's either Firepower or AMP. That part of the question "block certain applications from being used within the network" is making me vote for AMP.
aaInman
👍 17
Answer = B I work with Umbrella and Firepower daily. You can do this with Firepower, Umbrella whole existence is for blocking DNS connections to malicious sites before they are made, and blocking applications from launching on the internal network. For example, our users can't access Pandora, FB, Google Docs while on our internal network based on a policy configured in Umbrella.
MerlinTheWizard
👍 1
if you're working with them daily, how does umbrella handle connections to the same resources when using IP instead of FQDN?
Seawanderer
👍 1
Why not AMP? There’s a block list to avoid certain apps to run
SirFrates24
👍 2
The solution must be able to block certain applications from being used within the network. A would be the correct answer
Seawanderer
👍 1
I think it’s B. If the DNS resolution gets blocked, no connection will be initiated.
deathfrom
👍 1
I am torn between A & B as they both do what id required
dzef13
👍 2
Cisco Umbrella protects users from accessing malicious domains by proactively analyzing and blocking unsafe destinations – before a connection is ever made. Thus it can protect from phishing attacks by blocking suspicious domains when users click on the given links that an attacker sent.
Jayde
👍 2
B Cisco Umbrella protects users from accessing malicious domains by proactively analyzing and blocking unsafe destinations – before a connection is ever made. Thus it can protect from phishing attacks by blocking suspicious domains when users click on the given links that an attacker sent.
Jayde
👍 1
Cisco Umbrella protects users from accessing malicious domains by proactively analyzing and blocking unsafe destinations – before a connection is ever made. Thus it can protect from phishing attacks by blocking suspicious domains when users click on the given links that an attacker sent.
entitty
👍 2
B - stop it at the DNS request - prior to a connection being established
entitty
👍 1
Discovered Umbrella is limited to blocking apps. Firepower can block different apps, even from the same domain. - Voting back to A
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Cisco Umbrella is a cloud-delivered security platform that provides DNS-layer security. By intercepting DNS queries, it can block access to malicious domains and IPs before any connection is attempted or established. This aligns perfectly with the requirement to block "prior to a connection being established." Additionally, Umbrella offers application visibility and control (AVC) capabilities that allow organizations to block specific applications (like social media or streaming services) from running on the network, satisfying the second part of the requirement.Why the Other Options Are Wrong
Cisco Firepower (A) performs deep packet inspection and application control, but this occurs after the connection is established (Layer 3/4). While it can block applications, it cannot block them before the connection attempt starts in the same way DNS-layer security does. Cisco ISE (C) focuses on identity-based network access control and posture assessment, not pre-connection threat blocking via DNS. Cisco AMP (D) is an endpoint protection solution that analyzes file hashes and behavior after execution or arrival, which is too late for "pre-connection" blocking.Community Comment Notes
The community consensus strongly favors Cisco Umbrella (B). As user aaInman noted, "Umbrella whole existence is for blocking DNS connections to malicious sites before they are made." User west33637 clarified that while Firepower has AVC, it cannot block applications 'within the network' in the pre-connection sense implied by the question. Several users like jaciro11 emphasized that Umbrella enforces security at the DNS and IP layers, stopping threats before they reach endpoints.Official Reference
Exam Strategy
When a question mentions blocking threats "before a connection is established" or "at the DNS layer," immediately think of Cisco Umbrella. Do not confuse this with firewall features like IDS/IPS or Application Control, which operate after connectivity is initiated.
Frequently Asked Questions
Can Cisco Firepower block applications before connection?
No. Firepower's Application Control (AVC) inspects traffic after the TCP handshake is completed. It cannot prevent the initial connection attempt itself.
How does Umbrella block apps within the network?
Umbrella installs an endpoint agent or integrates with routers/DHCP to enforce policies. It blocks DNS queries for allowed/blocked apps, preventing the app from connecting to its server.