A payment processor is inserting one Threat Defense appliance between its cardholder application tier and the database tier. The security policy must drop known exploit traffic inline, and the business requires traffic to keep flowing if the appliance's Snort inspection process stops during maintenance. The budget funds a single chassis. Which forwarding behavior should the engineer set for the inline set?

Setting the inline set to fail open is correct because the continuity requirement applies when Snort’s inspection process stops: traffic continues through the appliance rather than being blocked by that process failure. When Snort is operating normally, inline enforcement can still drop known exploit traffic, and this behavior fits the budget for a single chassis. Using fail-open inspection with IPS set to detect known exploits preserves traffic flow, but detection alone does not drop the known exploit traffic, so it misses the enforcement requirement. Blocking inline while automatically restarting Snort is a security-first approach, but traffic remains blocked during the interruption, contrary to the continuity requirement. A synchronized two-chassis cluster could provide a high-availability design, but it exceeds the single-chassis budget and is not needed to meet the stated forwarding requirement. Exam caveat: distinguish a Snort inspection-process failure from a hardware or link failure; products may provide separate bypass controls and use different names for them. Practical check: verify the configured failure behavior and test a controlled Snort outage, confirming that traffic continues during the outage and that normal inline inspection still drops a known test signature.