A security team runs an intrusion policy in monitor mode on a managed FTD device and wants newly published detection rules to reach it automatically every night, without an engineer signing into the Management Center. Which update type under the Management Center's content updates should the team schedule to deliver that rule content?
Select an answer to reveal the explanation.
Short Explanation
You're after rule content, and intrusion rule updates are the only update type that carries it. Schedule recurring imports and enable automatic policy deployment so fresh Snort rules reach affected devices without anyone signing in. Signature currency works like a subscription: what matters is the new issue landing on schedule.
Full Explanation
The required content update is an intrusion rule import: it brings newly published detection rules into the Management Center so they can be used by the intrusion policy. Scheduling the import nightly and enabling automatic policy deployment satisfies both the requested cadence and the requirement to deliver the updated policy to the managed FTD without an engineer signing in. A nightly import followed by manual deployment has the right content and timing, but it still depends on an engineer to complete delivery, so it does not meet the hands-off requirement. A weekly import with automatic deployment removes that manual step, but newly published rules will not be delivered every night as requested. Automatically deploying the nightly update to a staging FTD is a reasonable validation workflow, but it does not update the managed device named in the scenario. Exam caveat: monitor mode affects how the policy handles detected traffic; it does not change which content update supplies intrusion rules or eliminate the need to deploy policy changes. Practical check: confirm the recurring intrusion-rule import schedule, automatic deployment settings, policy-to-device assignment, and successful deployment status for the intended FTD.