Which two application layer preprocessors are used by Firepower Next Generation Intrusion Prevention System? (Choose two.)

Question

Options

• ASIP
• Binline normalization
• CSSL
• Dpacket decoder
• Emodbus

• A
  92% (22)
• D
  4% (1)
• E
  4% (1)

Explanation

SIP and SSL are application layer preprocessors because they operate on protocols that function at Layer 7 - SIP handles VoIP signaling traffic inspection, while the SSL preprocessor decrypts and inspects encrypted SSL/TLS sessions before deep packet inspection can occur. These two are frequently highlighted in Cisco's Firepower curriculum as key application layer components because they address real-world traffic types (voice and encrypted web) that would otherwise evade inspection.

Why the distractors are wrong:

• B. Inline normalization - This is a preprocessor, but it operates at the network/transport layer (normalizes TCP/IP packets), not the application layer.
• D. Packet decoder - This is the first stage of Snort/Firepower's processing pipeline (decodes L2–L4 headers), not a preprocessor at all, and certainly not application layer.
• E. Modbus - While Modbus is technically an application layer protocol preprocessor in Firepower (used for ICS/SCADA), it is a specialized industrial protocol preprocessor, not one of the two primary ones tested in this context.

Memory tip: Think "SIP = Voice Apps, SSL = Secure Apps" - both are protocols that users actively run as applications, which is the clue that they belong to the application layer preprocessor category.

No community discussion yet for this question.