A retail chain must inspect traffic entering its payment environment and block exploit attempts before they reach the application servers. Its availability policy requires customer traffic to keep flowing when the Snort process is unavailable, even though inspection is briefly unavailable. Which NGIPS interface and failure policy combination meets both requirements?
Select an answer to reveal the explanation.
Short Explanation
An inline set puts traffic in the inspection path, so your intrusion policy can drop matching exploits; fail-open keeps customer traffic flowing if Snort goes down. It’s like a security gate that opens when the guard is unavailable rather than blocking the whole street.
Full Explanation
An inline set pairs two FTD interfaces in the traffic path, allowing the configured intrusion policy to drop matching exploit traffic. With fail-open enabled, traffic is allowed to continue if the Snort process becomes unavailable; this does not mean inspection continues during that period. Fail-closed instead blocks traffic when Snort is unavailable, violating the stated availability requirement. Passive interfaces fed by a SPAN mirror observe traffic without forwarding it through the sensor, so they cannot drop packets in the live traffic path. An alert-only policy can report matching traffic but does not meet the requirement to block exploits. The failure policy belongs to the inline set, not to the intrusion policy. The stated fail-open behavior concerns Snort process unavailability; it should not be read as a guarantee of traffic continuity through every device failure or upgrade.