A hospital's medical-imaging VLAN raises a stream of preprocessor events even though the traffic is legitimate, and the security lead wants the tuning to reach only that VLAN while every other VLAN keeps the default preprocessing, running entirely on the existing appliance. Which network analysis design should scope the preprocessor adjustment?
Select an answer to reveal the explanation.
Short Explanation
Decoding and preprocessing live in their own policy, so the tuning has to go where those settings are. You build a custom network analysis policy, then a network analysis rule matching the imaging VLAN invokes it for that traffic only. A relaxed appliance-wide default would loosen every VLAN, an intrusion policy governs detection rather than preprocessing, and a second appliance breaks the existing-appliance requirement.
Full Explanation
A custom network analysis policy is the right control for preprocessor behavior. Invoking it from a rule that matches only the medical-imaging VLAN scopes the adjustment to that traffic, while other VLANs continue using the default policy; it also uses the existing appliance. Setting the relaxed policy as the appliance-wide default is a plausible way to change preprocessing, but it broadens the change to every VLAN rather than isolating the imaging VLAN. A VLAN-specific intrusion policy can be selected through an access-control rule, but intrusion policies govern detection and response, not the network analysis policy’s preprocessing configuration, so it does not make the requested adjustment in the correct policy layer. A dedicated second appliance with its own relaxed network analysis policy could isolate the VLAN and preserve defaults on the existing appliance, but it violates the requirement to run entirely on the existing appliance. Exam caveat: policy names and rule-assignment mechanics vary by platform, so distinguish the policy controlling preprocessors from the intrusion policy controlling inspection and detection. Practical check: after deployment, verify the matching rule selects the intended network analysis policy, confirm its hit counters include imaging-VLAN traffic, and check that a representative flow from another VLAN still uses the default.