A user reports that connections from 10.14.6.30 to 10.22.9.7 on SMB fail. Packet Tracer output shows capture allowed, the access-list phase allowed the flow, route lookup resolving an egress interface, and the Snort phase reporting DROP with an intrusion rule named in its details. Which control should the engineer change first to clear the drop shown by Packet Tracer?
Select an answer to reveal the explanation.
Short Explanation
You read the phases in order and stopped at the one that actually said DROP: the Snort inspection phase. Each stage is a checkpoint stamp, and a pass at an earlier gate tells you that gate isn't your problem. The rule named in that phase is what needs tuning.
Full Explanation
Packet Tracer walks a simulated packet through the data path and reports the result for each stage. Capture, access-list and route lookup all returned allow in this output, which rules those stages out, while the Snort stage returned drop and named an intrusion rule, so the active intrusion policy is the control that must change; adjust that rule's action, variables or rule group so the flow passes. Reading the result as an access-list problem ignores the fact that the access-list stage already passed, and reordering rules cannot help a stage that never denied the packet. Treating it as a routing gap fails for the same reason, because route lookup already resolved an egress interface. Switching on logging is a sound diagnostic habit but it changes no inspection decision, so the drop continues. Exam caveat: phase names and their order can shift between Threat Defense releases, so read the result column rather than memorizing an index. Practical check: after you tune the rule, rerun Packet Tracer for the same source, destination and service, then confirm every stage reports allow before asking the user to retry.