An engineer is building a new access control policy using Cisco FMC. The policy must inspect a unique IPS policy as well as log rule matching. Which action must be taken to meet these requirements?

Question

Options

• AConfigure an IPS policy and enable per-rule logging.
• BDisable the default IPS policy and enable global logging.
• CConfigure an IPS policy and enable global logging.
• DDisable the default IPS policy and enable per-rule logging.

• A
  93% (39)
• C
  5% (2)
• D
  2% (1)

Explanation

In Cisco FMC, access control rules can each reference their own unique IPS policy - this allows different rules to apply different intrusion inspection profiles to different traffic segments. To log matches for specific rules (rather than all traffic), per-rule logging must be enabled on each access control rule individually. Per-rule logging is configured in the rule's Logging tab and records connection events when traffic matches that specific rule. Global logging applies broadly and does not offer the rule-specific granularity required here. Disabling the default IPS policy is not necessary - a custom IPS policy can be assigned to a rule without disabling the default, and doing so could reduce overall protection.

No community discussion yet for this question.