Quick Answer

The answer is dynamic micro-segmentation policy adjustment based on real-time risk scoring of endpoints, automated malware detection using behavioral patterns, and log-flow correlation to uncover attacker lateral movement. These three options represent realistic, risk-aware automation in network security operations, where the system dynamically isolates compromised hosts, identifies unknown threats without static signatures, and traces suspicious access patterns across the network. On the CCNA 200-301 v2 exam, this question tests your understanding of how automation enhances security posture by enabling adaptive, context-aware responses rather than rigid, all-or-nothing controls. A common trap is confusing operational convenience with security best practices—for example, deleting logs after 24 hours destroys forensic evidence, while applying one config to all devices ignores role-based risk. Remember the mnemonic “DAL” for Dynamic micro-segmentation, Automated detection, and Log correlation—these three rely on real-time data to drive decisions, unlike static or destructive actions.