How should this be addressed to block the traffic while allowing legitimate user traffic?

An organization is using a Cisco FTD and Cisco ISE to perform identity-based access controls. A network administrator is analyzing the Cisco FTD events and notices that unknown user traffic is being allowed through the firewall .

How should this be addressed to block the traffic while allowing legitimate user traffic?
A . Modify the Cisco ISE authorization policy to deny this access to the user.
B . Modify Cisco ISE to send only legitimate usernames to the Cisco FT
D . Add the unknown user in the Access Control Policy in Cisco FT
F . Add the unknown user in the Malware & File Policy in Cisco FT

Answer: C

Explanation:

Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/fdm/fptd-fdm-config-guide-640/fptd-fdm-identity.html#concept_655B055575E04CA49B10186DEBDA301A