A Cisco Firepower administrator needs to configure a rule to allow a new application that has never been seen on the network. Which two actions should be selected to allow the traffic to pass without

Question

Options

• Apermit
• Btrust
• Creset
• Dallow
• Emonitor

• A
  6% (3)
• B
  2% (1)
• C
  2% (1)
• D
  89% (42)

Explanation

In Cisco Firepower's access control policy, Allow (D) permits matching traffic to pass through the firewall - without deep packet inspection when no IPS policy is attached to the rule - while Monitor (E) logs the connection and continues rule evaluation without blocking, giving the administrator visibility into the new, unclassified application traffic. Together, these two actions let unknown application traffic flow while Firepower gathers data needed to eventually classify it.

Permit (A) is not a valid Firepower access control rule action - it belongs to traditional IOS ACLs, not FMC policy. Trust (B) bypasses all inspection including application identification, meaning Firepower can never classify or learn the new application, making it a poor choice for "never seen before" traffic. Reset (C) is a blocking action that terminates the TCP connection rather than allowing it.

Memory tip: Think "AM" = Admit and Monitor - you're letting the traffic in (Allow) while keeping an eye on it (Monitor). If you see "reset" or "trust" for an unknown app, ask yourself: one kills the connection, the other blindfolds the firewall.

No community discussion yet for this question.