Question

A security engineer deploys a Cisco FTD sensor inline between the distribution and access layers. An intrusion policy is applied with rules set to 'Generate Events'. After a demonstrated exploit, management demands that matching malicious traffic actually be dropped rather than just logged. The engineer verifies the rule state shows 'Drop and Generate Events'. However, testing shows the traffic is still passing while events are being generated. What is the MOST likely cause?

Accepted Answer

The FTD device or the intrusion policy is operating in a non-inline (detection-only) mode, so drop rules only generate events without dropping

Answer

The intrusion policy is being evaluated in the Security Intelligence phase, which cannot drop application-layer exploits

Answer

The access control policy default action is set to 'Trust', which bypasses all intrusion inspection

Answer

The rules must be set to 'Disabled' first and then re-enabled for the drop action to take effect