Which technique can be used to determine if an IP or service is a threat source within a security framework?

Which technique can be used to determine if an IP or service is a threat source within a security framework?

• A. Cisco IPS Source IP Reputation Filtering
• B. RFC 3704 Filtering
• C. Traffic Pattern Analysis
• D. Event Log Analysis

Answer: (A)

Reputation-based filtering uses threat intelligence to classify IP addresses and other sources as known threats. In a security framework, evaluating whether an IP or service is a threat source lets the system block or limit traffic from that source before it reaches sensitive resources. Cisco IPS Source IP Reputation Filtering does this directly by consulting threat-intelligence feeds to mark certain source IPs as malicious or suspicious and enforce blocking or restrictions accordingly, reducing exposure from compromised hosts, botnets, or scanners. RFC 3704 Filtering is about preventing spoofed addresses by ensuring packets have believable source addresses, not about judging whether the source itself is harmful. Traffic Pattern Analysis examines how traffic behaves to spot anomalies, which helps detect potential threats but doesn’t inherently tag a source as a threat by reputation. Event Log Analysis involves reviewing logs to detect and investigate incidents after they occur, rather than proactively identifying threat sources at the entry point.

Reputation-based filtering uses threat intelligence to classify IP addresses and other sources as known threats. In a security framework, evaluating whether an IP or service is a threat source lets the system block or limit traffic from that source before it reaches sensitive resources. Cisco IPS Source IP Reputation Filtering does this directly by consulting threat-intelligence feeds to mark certain source IPs as malicious or suspicious and enforce blocking or restrictions accordingly, reducing exposure from compromised hosts, botnets, or scanners.

RFC 3704 Filtering is about preventing spoofed addresses by ensuring packets have believable source addresses, not about judging whether the source itself is harmful. Traffic Pattern Analysis examines how traffic behaves to spot anomalies, which helps detect potential threats but doesn’t inherently tag a source as a threat by reputation. Event Log Analysis involves reviewing logs to detect and investigate incidents after they occur, rather than proactively identifying threat sources at the entry point.