In which two ways do access control policies operate on a Cisco Firepower system? (Choose two.)

Question

Options

• ATraffic inspection can be interrupted temporarily when configuration changes are deployed.
• BThe system performs intrusion inspection followed by file inspection.
• CThey can block traffic based on Security Intelligence data.
• DFile policies use an associated variable set to perform intrusion prevention.
• EThe system performs a preliminary inspection on trusted traffic to validate that it matches the

• A
  91% (48)
• B
  2% (1)
• D
  2% (1)
• E
  6% (3)

Explanation

A is correct: When configuration changes are deployed to a Firepower device, Snort (the inspection engine) must restart, which causes a brief interruption in traffic inspection. Depending on the device configuration, traffic may pass without inspection or be dropped during this window. C is correct: Access control policies can invoke Security Intelligence (SI) to block traffic based on reputation feeds (IP blocklists, URL categories, DNS lists) before deeper inspection occurs. B is incorrect: In Firepower, intrusion inspection and file inspection are both associated with the Allow action, but file inspection does not precede intrusion inspection in a fixed sequence that matches this option's framing. D is incorrect: Variable sets are used with intrusion policies, not file policies. E is incorrect: Trusted traffic (matching a Trust rule action) bypasses further inspection entirely-it is not 'preliminarily inspected'.

No community discussion yet for this question.