300-710 · Question #150
A network administrator needs to create a policy on Cisco Firepower to fast-path traffic to avoid Layer 7 inspection. The rate at which traffic is inspected must be optimized. What must be done to…
The correct answer is B. Configure a prefilter policy. A Prefilter Policy in Cisco Firepower is evaluated before the Access Control Policy and operates at Layer 2/3/4 using fast-path hardware offloading. Rules within a prefilter policy can be set to 'Fastpath', which bypasses the Snort engine (Layer 7 deep packet inspection)…
Question
A network administrator needs to create a policy on Cisco Firepower to fast-path traffic to avoid Layer 7 inspection. The rate at which traffic is inspected must be optimized. What must be done to achieve this goal?
Options
- AEnable the FXOS for multi-instance.
- BConfigure a prefilter policy.
- CConfigure modular policy framework.
- DDisable TCP inspection.
How the community answered
(64 responses)- A3% (2)
- B81% (52)
- C11% (7)
- D5% (3)
Explanation
A Prefilter Policy in Cisco Firepower is evaluated before the Access Control Policy and operates at Layer 2/3/4 using fast-path hardware offloading. Rules within a prefilter policy can be set to 'Fastpath', which bypasses the Snort engine (Layer 7 deep packet inspection) entirely for matching traffic and passes it directly to its destination at line rate. This is ideal for high-volume, trusted traffic (such as backup or voice) that does not need application-layer inspection. Configuring a prefilter policy directly addresses both requirements: avoiding Layer 7 inspection and optimizing throughput. FXOS multi-instance is about logical device segmentation, modular policy framework is an ASA concept, and disabling TCP inspection would not achieve targeted fast-pathing.
Topics
Community Discussion
No community discussion yet for this question.