300-710 · Question #243
Which access control policy action must be selected to inspect traffic for malware using cisco AMP for Networks?
The correct answer is D. allow. To inspect traffic for malware using Cisco AMP for Networks within an access control policy, the 'Allow' action must be selected. Once traffic is allowed, specific File Policy rules, which integrate AMP, can then be applied for deep content inspection.
Question
Which access control policy action must be selected to inspect traffic for malware using cisco AMP for Networks?
Options
- Amonitor
- Binspect
- Ctrust
- Dallow
How the community answered
(33 responses)- A6% (2)
- B3% (1)
- C3% (1)
- D88% (29)
Why each option
To inspect traffic for malware using Cisco AMP for Networks within an access control policy, the 'Allow' action must be selected. Once traffic is allowed, specific File Policy rules, which integrate AMP, can then be applied for deep content inspection.
The 'Monitor' action only logs traffic events without performing advanced inspection like AMP for Networks.
'Inspect' is not a primary top-level action in the same context as allow, block, trust, or monitor within an access control policy; inspection is enabled as a sub-action under 'Allow' for services like AMP or intrusion prevention.
The 'Trust' action bypasses all forms of inspection, including AMP for Networks, and allows traffic without any security analysis.
To perform advanced inspection such as malware analysis with Cisco AMP for Networks, traffic must first be permitted by an 'Allow' rule in the access control policy. Within an 'Allow' rule, you can then specify a File Policy that includes AMP for Networks to inspect the allowed traffic for malware.
Concept tested: Cisco Firepower AMP integration
Source: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/amp-for-networks-and-file-policy.html
Topics
Community Discussion
No community discussion yet for this question.