A data center team must place a Secure Firewall Threat Defense appliance inline between the web and application tiers, where attacks must be dropped and a reboot must never interrupt production, and inline before the payment segment, where traffic must stop whenever inspection is unavailable. Which inline interface configuration satisfies all three requirements?
Select an answer to reveal the explanation.
Short Explanation
Nicely done, you matched each segment's risk to its own fail mode. Fail-open keeps production moving when the appliance reboots, while fail-closed protects the payment link by stopping traffic. It's like choosing whether a gate swings open or locks shut when the guard steps away.
Full Explanation
An inline set is a pair of interfaces sitting physically in the traffic path, so every frame is presented to the inspection engine and a matching block rule can drop the flow before it reaches the far side; that is what makes inline the only mode that enforces rather than merely reports. Inside that topology each segment still needs its own failure behavior. Fail-open lets frames keep forwarding when the appliance stops inspecting, the right trade for a production tier whose outage costs more than a missed attack window, while fail-closed stops forwarding when inspection is unavailable, the correct trade for a payment segment where uninspected traffic is the greater risk. Applying fail-open everywhere leaves the payment link exposed during a reboot, and applying fail-closed everywhere violates the production availability requirement. Running the policy in monitor-only mode preserves both fail behaviors but removes enforcement, so matching flows are never dropped. Exam caveat: interface pairs can also be configured for monitoring rather than enforcement, so confirm the question asks about an inline deployment. Practical check: reboot the appliance in a window and watch which links keep forwarding.