Cisco Certified Internetwork Expert (CCIE) Practice Test

What action does the Botnet traffic Filter snooping take against suspicious connections?

1. It passes the traffic without logging

2. It logs and blocks them if necessary

3. It allows each connection provided it is a returning traffic

4. It restricts only local traffic

The correct answer is: It logs and blocks them if necessary

The action taken by the Botnet traffic Filter snooping against suspicious connections involves logging the traffic and blocking them if necessary. This approach enables the filter to monitor and analyze network traffic for patterns or signatures that are characteristic of botnet activity. When a suspicious connection is detected, the filter logs the details of the traffic for further analysis and may take action to block the connection if it poses a threat. This dual approach of logging and possible blocking is crucial in maintaining network security and preventing potential damage that botnets could inflict. In contrast, simply passing traffic without logging would not provide any visibility into potentially harmful activity, making it impossible to take preventive measures. Allowing each connection while only responding to returning traffic does not effectively mitigate the risks associated with inbound threats. Restricting only local traffic limits the filter's efficacy, as botnets can target external connections as well, thus necessitating a broader scope of monitoring and action.