A security engineer must configure policies for a recently deployed Cisco FTD. The security policy for the company dictates that when five or more connections from external sources are initiated…

An application detector identifies applications but does not monitor the frequency or rate of connections over time to trigger alerts based on thresholds.

An access control policy permits or denies traffic based on rules, but it does not inherently monitor event frequency or generate alerts based on connection thresholds over time.

A correlation policy in Cisco FMC is specifically designed to analyze multiple security events over a defined time period and trigger an action, such as an alert, when specific conditions or patterns, like a high rate of connections from external sources, are met. This allows detection of complex, time-based threat indicators.

An intrusion policy focuses on detecting individual malicious activities or known attack patterns within single traffic flows, not on aggregating multiple connection initiation events over a time window to identify suspicious behavior.