A university deploys an FTD inline and attaches an intrusion policy to an access-control rule. A permitted connection is later dropped by an inline Snort rule, and the engineer must explain which engine handled each stage. Which statement best describes Lina and Snort processing on this traffic?

In this FTD scenario, Lina handles routing, NAT, and connection processing, while Snort evaluates the access-control rule and inspects the traffic. Because the permitted connection has an intrusion policy attached, Snort can apply an inline rule that drops traffic; permission by the access-control rule does not prevent that inspection verdict from stopping the live connection. Describing Snort as seeing only mirrored packets misses the inline behavior: its verdict can affect the connection. Saying Snort finishes inspection before Lina processes the packet also overstates the order and makes Lina’s processing depend on that verdict. And treating Snort as an alert-only engine is incorrect because an inline rule can block, not merely report, traffic. The exam caveat is that the exact packet path can include additional stages and depend on configuration, so avoid assuming a universal sequence beyond the roles described here. For a practical check, inspect the access-control rule and attached intrusion policy in FMC, then review connection and intrusion events to confirm the rule action and observed drop.