A retail chain places an FTD sensor at the data center edge so exploit traffic is blocked while it crosses the production path. Some policy deployments restart the inspection engine, and the network team requires traffic to continue forwarding during those restarts. Which NGIPS interface mode blocks exploits while allowing traffic to pass uninspected during an engine restart?
Select an answer to reveal the explanation.
Short Explanation
With an inline set and Snort fail-open, you'll block exploits during normal inspection while traffic keeps flowing uninspected if the engine restarts—like opening a bypass lane. Fail-closed drops traffic, and tap mode doesn't block inline.
Full Explanation
An inline set puts the FTD interface pair directly in the production forwarding path, allowing the sensor to inspect and block exploit traffic as it crosses the network. With Snort fail-open enabled, if the Snort inspection engine restarts or is otherwise unavailable, the device continues forwarding traffic without inspection; blocking resumes when Snort is available again. This meets both requirements: inline exploit prevention during normal operation and continued forwarding during an engine restart. The fail-closed approach is unsuitable because it drops traffic while Snort is down, interrupting connectivity. Tap mode is also unsuitable: it forwards traffic for monitoring but does not block exploits inline. Hardware bypass is not the mechanism for this event because it does not engage for a Snort process restart. Exam caveat: fail-open preserves forwarding, not session state, so existing connections may still reset; uninterrupted forwarding does not guarantee uninterrupted user sessions. Practical check: confirm the configured inline-set fail-open behavior on the specific deployment and validate it during a controlled Snort restart, checking both traffic forwarding and whether sessions survive.