nerdexam
Cisco

300-710 · Question #258

Which action must be taken on the Cisco FMC when a packet bypass is configured in case the Snort engine is down or a packet takes too long to process?

The correct answer is B. Enable Automatic Application Bypass. When configuring packet bypass for scenarios where the Snort engine is down or overloaded, the Cisco FMC administrator must enable Automatic Application Bypass. This feature ensures network connectivity by allowing traffic to flow even if Snort cannot process it.

Configuration

Question

Which action must be taken on the Cisco FMC when a packet bypass is configured in case the Snort engine is down or a packet takes too long to process?

Options

  • AEnable Inspect Local Router Traffic
  • BEnable Automatic Application Bypass
  • CConfigure Fastpath rules to bypass inspection
  • DAdd a Bypass Threshold policy for failures

How the community answered

(40 responses)
  • A
    3% (1)
  • B
    90% (36)
  • C
    5% (2)
  • D
    3% (1)

Why each option

When configuring packet bypass for scenarios where the Snort engine is down or overloaded, the Cisco FMC administrator must enable Automatic Application Bypass. This feature ensures network connectivity by allowing traffic to flow even if Snort cannot process it.

AEnable Inspect Local Router Traffic

"Inspect Local Router Traffic" is a setting to control whether self-generated traffic by the FTD itself is inspected, not a mechanism for bypassing Snort due to engine failures.

BEnable Automatic Application BypassCorrect

Automatic Application Bypass (AAB) is the specific Cisco Firepower feature designed to allow packets to bypass the Snort inspection engine under conditions of high load, resource exhaustion, or engine failure. This ensures network connectivity and prevents traffic drops when the Snort engine cannot keep up with processing or is unavailable.

CConfigure Fastpath rules to bypass inspection

Configuring fastpath rules to bypass inspection is a deliberate performance optimization for trusted traffic, managed via prefilter policies, and is not an automatic fail-safe mechanism triggered by Snort engine failures or overloads.

DAdd a Bypass Threshold policy for failures

While the concept sounds related, "Automatic Application Bypass" is the precise terminology for the feature that handles packet bypass during Snort engine failures or processing delays, not a "Bypass Threshold policy for failures."

Concept tested: Snort engine bypass for failures (AAB)

Source: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/intrusion-policies.html

Topics

#Automatic Application Bypass#Snort engine#Packet bypass#Cisco FMC

Community Discussion

No community discussion yet for this question.

Full 300-710 Practice