Cisco Umbrella DNS-Layer Security for Pre-Connection Blocking

350-701 By islever Editorial Last updated

Describe the controls used to protect against phishing and social engineering attacks

Short answer

B Cisco Umbrella uses DNS-layer security to block malicious destinations and applications before a connection is established.

Question

An organization is trying to improve their Defense in Depth by blocking malicious destinations prior to a connection being established. The solution must be able to
block certain applications from being used within the network. Which product should be used to accomplish this goal?
  1. Cisco Firepower
  2. Cisco Umbrella Correct Answer
  3. Cisco ISE
  4. Cisco AMP

Key Takeaways

The key trap is confusing traditional firewall application control with DNS-layer security; only Umbrella blocks requests at the DNS resolution phase, effectively preventing the connection from ever being established.

This question tests the capability of Cisco Umbrella to block malicious destinations prior to connection establishment using DNS-layer security. It establishes that Umbrella is the correct choice for blocking applications within a network before connections are made.

Common mistake: Many candidates choose Cisco Firepower (A) because it has Application Control (AVC), but Firepower inspects traffic after the TCP handshake begins, meaning the connection is already partially established.

Expert Analysis

Why the Answer Is Correct

Cisco Umbrella is a cloud-delivered security platform that provides DNS-layer security. By intercepting DNS queries, it can block access to malicious domains and IPs before any connection is attempted or established. This aligns perfectly with the requirement to block "prior to a connection being established." Additionally, Umbrella offers application visibility and control (AVC) capabilities that allow organizations to block specific applications (like social media or streaming services) from running on the network, satisfying the second part of the requirement.

Why the Other Options Are Wrong

Cisco Firepower (A) performs deep packet inspection and application control, but this occurs after the connection is established (Layer 3/4). While it can block applications, it cannot block them before the connection attempt starts in the same way DNS-layer security does. Cisco ISE (C) focuses on identity-based network access control and posture assessment, not pre-connection threat blocking via DNS. Cisco AMP (D) is an endpoint protection solution that analyzes file hashes and behavior after execution or arrival, which is too late for "pre-connection" blocking.

Community Comment Notes

The community consensus strongly favors Cisco Umbrella (B). As user aaInman noted, "Umbrella whole existence is for blocking DNS connections to malicious sites before they are made." User west33637 clarified that while Firepower has AVC, it cannot block applications 'within the network' in the pre-connection sense implied by the question. Several users like jaciro11 emphasized that Umbrella enforces security at the DNS and IP layers, stopping threats before they reach endpoints.

Exam Strategy

When a question mentions blocking threats "before a connection is established" or "at the DNS layer," immediately think of Cisco Umbrella. Do not confuse this with firewall features like IDS/IPS or Application Control, which operate after connectivity is initiated.

Frequently Asked Questions

Can Cisco Firepower block applications before connection?

No. Firepower's Application Control (AVC) inspects traffic after the TCP handshake is completed. It cannot prevent the initial connection attempt itself.

How does Umbrella block apps within the network?

Umbrella installs an endpoint agent or integrates with routers/DHCP to enforce policies. It blocks DNS queries for allowed/blocked apps, preventing the app from connecting to its server.

More 350-701 FAQ →

Discussion 60 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 60

  1. aaInman 👍 17
    Answer = B I work with Umbrella and Firepower daily. You can do this with Firepower, Umbrella whole existence is for blocking DNS connections to malicious sites before they are made, and blocking applications from launching on the internal network. For example, our users can't access Pandora, FB, Google Docs while on our internal network based on a policy configured in Umbrella.
  2. west33637 👍 7 Answered B
    B is correct. AVC on Firepower can not block applications from being used 'within the network'. Firepower can only block these applications if they pass through the firewall. Umbrella can block connections to malicious sites before the connection is made based on the DNS lookup. Umbrella also installs an endpoint supplicant or can be used as an Anyconnect module. This way you can push an application policy to the endpoints blocking even applications 'within the network'. Same as aalnman, I have used this at work and at home.
  3. AS04 👍 7
    A is correct, Firepower has AVC feature that can block traffic based on application.
  4. manhatar 👍 5
    I was going with several people here : Umbrella. But after reading jaciro, I agree with firepower. Indeed Umbrella can block before the connection has established. Indeed firepower has to let pass some packets before application recognition (so before the connection has established doesn't work). BUT here we are saying :"blocking malicious destinations prior to a connection being established" and don't forget that in DAQ we have Security Intelligence able to block before the connection has establish for IP Blacklist AND URL blacklist. Si for me firepower can block before a connection with SI.
  5. ureis 👍 5
    I managing a Umbrella of our costumer and this is what Umbrella is showing to us when i go to "DNS POLICIES": "Control Applications - Select applications or application categories you'd like to block or Allow for the users in your organization" In other hand you can do the same on Firepower ACP blocking applications. Maybe the magic word here be: "prior to a connection being established" I'll choose B
Show 25 more comments
  1. jaciro11 👍 4
    The answer is Umbrella: By enforcing security at the DNS and IP layers, Umbrella blocks requests to malware, ransomware, phishing, and botnets before a connection is even established — stopping threats over any port or protocol before they reach your network or endpoints. Umbrella provides coverage for all connected devices – including roaming laptops, Android and iOS devices, and delivers great time-to-value. The same apply to APPs. https://umbrella.cisco.com/why-umbrella/top-reasons-to-trial
  2. nomanlands 👍 4 Answered D
    The key here is "within the network". Umbrella will block DNS if the application is using DNS, Firepower can block things leaving the network, but not things within a network. Therefore, it would be EDR software.
  3. jaciro11 👍 3
    All the people here told Umbrella: But the question is tricky. They ask about a connection. If I want to block a destination and If this destinations is an IP through Umbrella this is not possible, but thought firepower it is possible, also they dont ask about domains, they speak about possible destinations (Domains and IPs). Thats why I think the correct answer is A Again people, remember firepower can block and the beginning of the connection or at the end. Also block malware, malicious domains, Block Apps and more efficient than umbrella. The only improvement in umbrella is detect malicious destinations thought DNS and the easy deployment vs firepower.
  4. sull3y 👍 3
    The answer is B. Cisco Umbrella. Cisco Umbrella is a cloud-based security solution that provides advanced threat protection and blocks malicious destinations before a connection is established. It uses DNS-layer security to block requests to known malicious domains and IPs, and it also has the capability to block certain applications from being used within the network. By implementing Cisco Umbrella, the organization can improve their defense in depth by preventing malicious traffic from entering the network, thus reducing the risk of a successful cyber attack.
  5. TesterDude 👍 3 Answered D
    I'm going with D here because it specifically states blocking the APPLICATION before connection is established, which is done with AMP for Endpoints Application Control: AMP for Endpoints Application Control: Like files, applications can be detected, blocked, and whitelisted. As with the other files, AMP does not look for the name of the application but the SHA-256 hash. Santos, Omar. CCNP and CCIE Security Core SCOR 350-701 Official Cert Guide (p. 644). Pearson Education. Kindle Edition.
  6. klu16 👍 3
    I'm going with B - Cisco Umbrella. "By enforcing security at the DNS and IP layers, Umbrella blocks requests to malware, ransomware, phishing, and botnets BEFORE A CONNECTION IS EVEN ESTABLISHED — stopping threats over any port or protocol before they reach your network or endpoints. Umbrella provides coverage for all connected devices – including roaming laptops, Android and iOS devices, and delivers great time-to-value."
  7. coentror 👍 3
    It is B - Umbrella: https://www.cisco.com/c/m/en_il/training-events/experience-it-umbrella/index.html "Cisco Umbrella uses the internet’s infrastructure to block malicious destinations before a connection is ever established. Umbrella uses DNS to stop threats over all ports and protocols — even direct-to-IP connections. Stop malware before it reaches your endpoints or network."
  8. Sparrsh 👍 3
    Answer is B,, because Cisco Umbrella uses the internet's infrastructure to block malicious destinations before a connection is ever established. https://www.cisco.com/c/m/en_il/training-events/experience-it-umbrella/index.html#:~:text=Cisco%20Umbrella%20uses%20the%20internet's,reaches%20your%20endpoints%20or%20network.&text=Register%20now%20to%20secure%20your%20spot!
  9. Reece_S 👍 3
    I'm going with A only because the question stated improving their Defense in Depth which works by placing multiple layers of defense on the network to create a series of overlapping and redundant defenses. Firepower has integrations with Umbrella and AMP. So if they both fail at blocking the destination and running the application, Firepower can still do it.
  10. zap_pap 👍 3
    Ridiculous question. Umbrella uses DNS for decision making, what if applications is using direct IP connection? Umbrella will not stop it. It's either Firepower or AMP. That part of the question "block certain applications from being used within the network" is making me vote for AMP.
  11. batoussai 👍 3
    B-Umbrella can block apps as well, next to block destinations before a connection: https://docs.umbrella.com/umbrella-user-guide/docs/advanced-app-controls
  12. Pwned 👍 3 Answered B
    Cisco Umbrella is the correct answer
  13. Jessie45785 👍 2 Answered D
    The solution must be able to block certain applications from being used within the network I really think it is D cause: - NGFW cannot stop it in L2 - Umbrella can block only DNS protocol - what about all the other ones - wont be able to detect it - WSA - proxy will definitely will not help here ... but AMP can block application from being able to start hence cutting it from TCP stack and fulfilling a requirement of "blocking malicious destinations prior to a connection being established" but it is Cisco so you never know :/
  14. psuoh 👍 2
    I think A is the Cisco's correct answer. the question asks "within the network". Umbrella would do on and off the network/app blocking. Similarily, firepower can do network/app block for the network. Umbrella would be a overkill for a "organization". https://community.cisco.com/t5/network-security/firepower-or-umbrella-for-blocking-urls-applications-ip/td-p/4430076
  15. sis_net_sec 👍 2 Answered B
    https://www.cisco.com/c/m/en_il/training-events/experience-it-umbrella/index.html Cisco Umbrella uses the internet’s infrastructure to block malicious destinations before a connection is ever established. Umbrella uses DNS to stop threats over all ports and protocols — even direct-to-IP connections. Stop malware before it reaches your endpoints or network.
  16. Jayde 👍 2
    B Cisco Umbrella protects users from accessing malicious domains by proactively analyzing and blocking unsafe destinations – before a connection is ever made. Thus it can protect from phishing attacks by blocking suspicious domains when users click on the given links that an attacker sent.
  17. dzef13 👍 2
    Cisco Umbrella protects users from accessing malicious domains by proactively analyzing and blocking unsafe destinations – before a connection is ever made. Thus it can protect from phishing attacks by blocking suspicious domains when users click on the given links that an attacker sent.
  18. dr4gn00t 👍 2
    Once again question with multiple valid answers. We just have see what is the exact wording in test and hopefully that will make it easier to choose between A, B or D..
  19. royallyre20 👍 2 Answered A
    Umbrella can block destination depending on DNS and cannot block application. Firepower can block destination and application using application control function.
  20. SirFrates24 👍 2
    The solution must be able to block certain applications from being used within the network. A would be the correct answer
  21. Toni_Su91 👍 2
    Prior to a connection being established - This is classic Umbrella - DNS security is first line of defence.
  22. SegaMasterSystemAdmin 👍 2 Answered A
    Its not Umbrella, Umbrella cannot block certain applications, so has to be Firepower.
  23. entitty 👍 2
    B - stop it at the DNS request - prior to a connection being established
  24. 4pelos 👍 2
    Correct answer B. Checked in securitytut
  25. Emlia1 👍 2 Answered B
    It's B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is a Feature of an Endpoint Detection and Response Solution?

S-grade

Which Two Methods Belong in an AAA Authentication Method List?

S-grade

Preventing Unauthorized DHCP Servers on Cisco Switches

S-grade

What Is Considered a Cloud Data Breach in Cisco 350-701?

S-grade

← Back to 350-701 Study Guide