A Cisco Secure Firewall Threat Defense device is configured in inline IPS mode to inspect all traffic that passes through the interfaces in the inline set. Which setting in the inline set…

The correct answer is D. Snort Fail Open. When a Vulnerability Database (VDB) update is applied to an FTD in inline IPS mode, the Snort inspection engine must briefly restart to load the new signatures. During this restart window, Snort Fail Open (D) must be enabled in the inline set configuration so that traffic…

Configuration

Question

A Cisco Secure Firewall Threat Defense device is configured in inline IPS mode to inspect all traffic that passes through the interfaces in the inline set. Which setting in the inline set configuration must be selected to allow traffic to pass through uninterrupted when VDB updates are being applied?

Options

ATap Mode
BStrict TCP Enforcement
CPropagate Link State
DSnort Fail Open

How the community answered

(30 responses)

A
7% (2)
B
3% (1)
D
90% (27)

Explanation

When a Vulnerability Database (VDB) update is applied to an FTD in inline IPS mode, the Snort inspection engine must briefly restart to load the new signatures. During this restart window, Snort Fail Open (D) must be enabled in the inline set configuration so that traffic passes through the device without inspection rather than being dropped. Without Fail Open, traffic would be blocked during the Snort restart, causing an outage. Tap Mode (A) mirrors traffic for inspection without blocking but changes the deployment model entirely and is not a setting to apply to an existing inline deployment for update windows. Strict TCP Enforcement (B) enforces TCP handshake validation and does not affect update behavior. Propagate Link State (C) synchronizes link state across inline pairs and is unrelated to inspection continuity during updates.

Topics

#Cisco FTD#Inline IPS#Fail-Open#VDB Updates

Community Discussion

No community discussion yet for this question.

Full 300-710 Practice