Cisco Certified Internetwork Expert (CCIE) Practice Test

Which command is required for the botnet filter on Cisco ASA to function properly?

1. dynamic-filter inspecttcp/80

2. dynamic-filter whitelist

3. inspect botnet

4. inspect dns dynamic-filter-snoop

The correct answer is: inspect dns dynamic-filter-snoop

The command necessary for the botnet filter on a Cisco ASA to function properly is the one that allows the dynamic filtering of DNS traffic. Dynamic filtering is crucial for identifying and mitigating botnet activities, as many botnets use DNS to communicate with command and control servers. By employing the command to inspect DNS traffic and to enable dynamic filtering, the ASA device can analyze DNS queries and responses, which helps it determine whether the traffic is associated with known botnet activity. The use of dynamic filtering with DNS is particularly important because DNS can be a key vector for botnet communication. If the ASA can accurately inspect and understand the DNS traffic, it can take appropriate action to block or mitigate botnet-related threats more effectively. Other commands such as inspecting specific TCP ports or whitelisting are less relevant to the core function needed for botnet detection and blocking based on DNS lookups and their characteristics, which are central to botnet operations.