Nightly backups between two data center subnets saturate inspection resources on a Cisco Secure Firewall (FTD), even though the backup flow is fully trusted and must still be logged as allowed. Which approach reduces inspection load for this flow?
Select an answer to reveal the explanation.
Short Explanation
When you've got a giant, trusted backup stream, running every byte through IPS is like searching every truck from your own warehouse. Trust or Fastpath waves it through without the deep search. Just remember the trade: you give up inspection, so only do it for traffic you truly trust.
Full Explanation
Deep inspection consumes resources for every byte it examines. For a high-volume, well-understood flow between trusted data center subnets, FTD offers two ways to skip it: an access control rule with the Trust action, which passes traffic without intrusion, file or further policy inspection, and a prefilter rule with the Fastpath action, which bypasses the inspection engine entirely. Both can log connections, satisfying the requirement to record the flow as allowed. An Allow rule with a lighter intrusion policy still sends the flow through deep inspection, so it reduces work only marginally and keeps the bottleneck. Monitor is a logging action that continues evaluation to later rules; it does not permit or exempt traffic, so the flow would still be handled by whatever rule matches next. A block-with-reset rule tears down the connection; following it with an allow rule cannot help because the first matching rule decides, and blocking backups defeats the purpose. Exam caveat: bypassing inspection is a deliberate risk decision, so scope these rules tightly by source, destination and port, and never trust broad or internet-facing traffic. Operational check: create the narrowly scoped rule, deploy, run the backup, confirm connection events show the trust or fastpath action, and verify that inspection engine utilization drops during the backup window.