An engineer must deploy a Cisco FTD appliance via Cisco FMC to span a network segment to detect malware and threats. When setting the Cisco FTD interface mode, which sequence of actions meets this…

Setting the interface mode to passive allows the FTD to monitor traffic on a spanned segment without being in-line, enabling it to detect threats without impacting traffic flow. Configuring an Access Control policy with an intrusion policy and a file policy is essential to specifically detect intrusions and identify malware within the monitored traffic.

While a passive interface is correct, a prefilter policy is primarily used for optimizing traffic processing or fastpathing, not for deep inspection and detection of malware and threats, which require intrusion and file policies.

Setting the interface mode to "none" is not a valid or appropriate configuration for spanning a network segment for threat detection; passive mode is required for this use case. Prefilter policies are also not sufficient for comprehensive malware/threat detection.

Setting the interface mode to "none" is incorrect for a span deployment. While intrusion and file policies are needed for detection, the interface mode must be "passive" to achieve monitoring on a spanned segment.