An engainer must add DNS-specific rules to me Cisco FTD intrusion policy. The engineer wants to use the rules currently in the Cisco FTD Snort database that are not already enabled but does not want…

"Dynamic state" refers to how rules behave based on network conditions or global settings, not the primary mechanism for individually enabling or disabling specific rules from the database.

Changing the "base policy" (like to Security over Connectivity) applies a predefined set of rules, which would likely enable many rules beyond the specific DNS ones needed and might disable others.

To add specific DNS-related intrusion rules that are not currently enabled without activating unnecessary rules, an engineer must manually adjust the "rule state" for those particular rules within the active intrusion policy. This allows for precise, granular control over which individual Snort rules are active, ensuring only the required DNS-specific rules are enabled and meeting the requirement of not enabling more than needed.

The "Generate and Use Recommendations" feature automatically suggests rules based on network traffic, which could enable many more rules than just the specific DNS ones desired, potentially exceeding the "not more than needed" requirement.