300-710 Securing Networks with Cisco Firepower (300-710 SNCF) v1.2 Questions and Answers

Name → HTTP-HTTPS-QoS

Apply QoS On → Interfaces in Destination Interface Objects

Download/Upload Limit → 5 Mb/s

Source Interface Networks → 192.168.1.0/24

Destination Interface Networks → 192.168.2.0/24

Destination Ports → HTTP-HTTPS

The HR workstation resides on the inside 192.168.1.0/24 network, making that subnet the source-interface network. Internet-bound traffic exits through the 192.168.2.0/24 network, which must be configured as the destination-interface network. Because rate limiting must occur as traffic leaves toward the internet, QoS is applied to interfaces in the destination interface objects. The HTTP-HTTPS object identifies the destination ports for web traffic, while HTTP-HTTPS-QoS provides a descriptive rule name. Both download and upload limits are configured as 5 Mb/s. Cisco Secure Firewall applies a QoS limit independently on each selected interface and determines upload and download direction based on the connection initiator. The Apply QoS On selection must correspond to a populated source or destination interface condition. Cisco Secure Firewall QoS configuration

To determine if a host is infected with malware, the network administrator can look at the Indications of Compromise (IOC) feature in Cisco FMC. The IOC feature analyzes network and endpoint data collected by Firepower sensors and AMP for Endpoints connectors, and identifies hosts that exhibit signs of compromise or infection. The IOC feature uses predefined rules based on Cisco Talos intelligence and other sources to detect IOCs on hosts. One of these rules is CnC Connected, which indicates that a host has communicated with a command-and-control (CnC) server that is known to be associated with malware activity2.

To view the IOC information for a host, the network administrator can navigate to Analysis > Hosts > Indications of Compromise in Cisco FMC, and select a host from the table. The IOC Details page will show the IOC events for that host, including the CnC Connected event, along with other information such as severity, timestamp, source, destination, protocol, and rule name. The network administrator can also view more details about each IOC event by clicking on it2.

The other options are incorrect because:

Analysis > Files > Malware Events shows information about files that have been detected as malware by Firepower sensors or AMP for Endpoints connectors. This does not show information about hosts that are infected with malware or have communicated with CnC servers3.

Analysis > Hosts > Host Attributes shows information about hosts that have been discovered by Firepower sensors, such as IP address, MAC address, operating system, applications, users, vulnerabilities, and so on. This does not show information about IOCs or CnC connections on hosts4.

Analysis > Files > Network File Trajectory shows information about files that have traversed your network and have been detected by Firepower sensors or AMP for Endpoints connectors. This allows you to track where a file came from, where it went, and what happened to it along the way. This does not show information about hosts that are infected with malware or have communicated with CnC servers5.

https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/212702-configure-and-verify-nat-on-ftd.html

A low-impact attack indicates that the host is not vulnerable to those attacks. A low-impact attack is an attack that does not exploit any known vulnerability on the target host or does not match any signature or anomaly rule on the FTD device5. A low-impact attack does not mean that the attack is not dangerous to the network or that the host is not within the administrator’s environment. It simply means that the attack did not succeed in compromising or affecting the host.

The other options are incorrect because:

All attacks are not listed as low until manually categorized. The FTD device automatically assigns an impact level to each attack based on various factors, such as vulnerability information, threat score, and confidence rating5. The impact level can be high, medium, or low, depending on how likely and how severe the attack is.

The attacks are not necessarily harmless to the network. A low-impact attack may still cause some damage or disruption to the network, such as consuming bandwidth, generating noise, or distracting attention from other attacks6. A low-impact attack may also indicate that the attacker is probing or scanning the network for potential vulnerabilities or weaknesses7.

The host is not necessarily outside the administrator’s environment. A low-impact attack can target any host on the network, regardless of its location or ownership. A low-impact attack does not imply that the host is external or irrelevant to the administrator’s environment.

Cisco Security Analytics and Logging (SaaS) licenses come with a default data retention period of 90 days. This retention period allows organizations to store and analyze their security event data for up to 90 days, providing sufficient time for security monitoring and forensic investigations.

SNMP provides nonintrusive, read-only monitoring of Secure Firewall Threat Defense devices and is appropriate for collecting high-level device statistics without interrupting production traffic. An external network management system can poll supported Management Information Base objects to obtain CPU utilization, memory usage, interface statistics, Snort information, process status, high-availability state, and cluster health. SNMP traps can also report important events without requiring continuous manual access to the device. Malware reports focus on malicious files and malware events, while risk reports summarize security risks and attacks. Host reports describe discovered hosts, applications, operating systems, and vulnerabilities rather than overall device performance. Because the requirement concerns device-level statistics and minimizing operational disruption during peak season, SNMP monitoring is the most appropriate choice. Cisco Secure Firewall SNMP monitoring

================

Individual intrusion rules do not support direct time-range conditions or scheduled activation triggers. Instead, the administrator creates a time-range object and uses it as a condition in an access control rule. The required intrusion policy is then associated with that access control rule. During the specified time range, matching traffic invokes the intrusion policy and its enabled intrusion rules; outside the range, the access control rule does not match. Multiple access control rules can be created when different intrusion policies or protection levels are needed at different times. Secure Firewall Management Center does not require an external scheduled task to enable and disable individual intrusion rules. Cisco documents time-range objects as the mechanism for making supported policies apply only during defined periods. Therefore, time-based access control rules are the correct implementation. Cisco time-range objects

A passive interface is specifically designed to monitor copied network traffic received from a switch SPAN or mirror port. Because the Secure Firewall Threat Defense device is not physically placed in the traffic path, it receives a copy of the packets for inspection but does not retransmit them. This provides network and intrusion visibility without affecting production traffic. The trade-off is that a passive deployment cannot directly block, shape, or modify the monitored traffic because the original packets continue through the switch independently. An inline deployment, by comparison, places paired interfaces directly in the forwarding path and can drop malicious traffic. Routed and transparent describe firewall forwarding modes and are not the appropriate SPAN-based IPS interface type. Therefore, a SPAN-port monitoring deployment requires a passive interface. Cisco passive-interface documentation

================

In Cisco Secure Firewall Management Center (FMC), when two users attempt to modify a VPN policy simultaneously, the system implements a locking mechanism to prevent conflicts. The first user who selects edit on the policy locks the configuration, preventing other users from making changes until the lock is released.

Steps:

When the first user selects edit on the VPN policy, FMC locks the policy for editing.

The lock ensures that only the first user can make changes.

Once the first user saves or cancels their changes, the lock is released.

Other users can then edit the policy.

This locking mechanism ensures that configuration conflicts are avoided and only one set of changes is applied at a time.

The Interface Traffic widget belongs to the Operations category because it displays operational information about appliance interfaces, specifically received and transmitted traffic rates. After selecting Add Widgets, the engineer can select All Categories and open Operations to locate Interface Traffic, then click Add next to the widget. Analysis & Reporting contains widgets based on collected security events and analytical data. Miscellaneous contains widgets that display neither event nor operational data, such as the RSS Feed widget. “New” is not a valid predefined widget category. Cisco classifies Operations widgets as those that display system status and overall health information. The Interface Traffic widget is not included on predefined dashboards by default, so it must be added manually using this procedure. Cisco Secure Firewall dashboard documentation

================

A file policy defines the actions that the Cisco Firepower Threat Defense (FTD) device should take when it encounters different types of files. The file policy is applied as part of an access control policy. If an access control policy does not include a file policy, the FTD device will not take any action on the files it encounters, resulting in a disposition of " unknown " for all file types except exe.

If an engineer receives a 403: Forbidden error when attempting to download a packet capture file from Cisco Secure Firewall Management Center (FMC), the issue is likely due to HTTPS not being enabled in the device platform policy. To resolve this issue, the engineer must enable HTTPS in the platform policy.

Steps:

In FMC, navigate toPolicies > Device Management > Platform Settings.

Edit the relevant platform policy.

Enable HTTPS for the device.

Deploy the changes to the FTD device.

This ensures that the FMC and FTD device can securely transfer the packet capture file over HTTPS, resolving the 403 error.

The Threat Defense device cannot change its firewall mode while it has an active manager configuration. After unregistering the device from Management Center, the engineer must execute configure manager delete to remove the manager association and place the device in No Manager Mode. The engineer can then execute configure firewall transparent to change the operating mode. Changing firewall modes clears the device configuration because routed-mode and transparent-mode interface configurations are incompatible. After completing the conversion, the engineer must configure the Management Center association again with configure manager add and register the device. Options A and B are not valid Threat Defense CLI commands. Option D performs the actual mode conversion, but it is not the first required CLI command while the manager association remains configured. Cisco Threat Defense command reference

================

Disseminate: The dissemination phase publishes the results of the investigation or threat hunt. This information is disseminated with a focus on the receivers of the information. At the tactical level, this information feeds back into the beginning of the F3EAD model, Find. Figure 3 illustrates the F3EAD model.

To integrate a third-party security intelligence feed with Cisco Secure Firewall Management Center (FMC) using Threat Intelligence Director (TID), the following actions are necessary:

Upgrade to version 6.6:The FMC must be running at least version 6.6 to support Threat Intelligence Director. Version 6.2.3 does not support the necessary features for this integration.

Add the URL of the TAXII server:Threat Intelligence Director uses TAXII (Trusted Automated eXchange of Indicator Information) to pull threat intelligence data from third-party sources. The URL of the TAXII server must be added to the TID configuration in FMC.

Steps:

Upgrade FMC to version 6.6 or later.

In FMC, navigate toIntegration > Threat Intelligence Director.

Add a new TAXII server by entering the URL of the TAXII server.

These actions enable the integration of third-party threat intelligence feeds, enhancing the security capabilities of the FMC.

When performing packet capture on a Cisco Secure Firewall Threat Defense (FTD) device, ensuring that the allocated memory is sufficient is crucial for capturing all necessary traffic during a specified capture session. If users experience issues accessing a server and the engineer suspects not all traffic was collected, it indicates that the current memory allocation might not be enough to store the entire capture data for the 15-minute session.

Steps:

Check the current memory allocation for packet captures on the FTD device.

Increase the memory allocation if it is insufficient to handle the volume of traffic expected during the capture session.

This ensures that all relevant traffic is captured and can be analyzed to diagnose and resolve the network issue.

To configure IPS mode on a Cisco Secure Firewall Threat Defense (FTD) device to inspect traffic and act as an IDS, the network engineer must configure an intrusion policy on the FTD device. The passive-interface and SPAN on the switch have already been configured, which means the traffic is being mirrored to the FTD. The next step is to set up an intrusion policy that defines the rules and actions for detecting and responding to malicious traffic.

Steps:

In FMC, navigate toPolicies > Intrusion.

Create a new intrusion policy or edit an existing one.

Define the rules and actions for detecting threats.

Apply the intrusion policy to the relevant interfaces or access control policies.

This configuration enables the FTD to inspect the mirrored traffic and take appropriate actions based on the defined intrusion policy.

Explanation

To change the mode of a Cisco Secure Firewall Threat Defense (FTD) device in the Cisco Secure Firewall Management Center (FMC) inventory, the engineer must follow these steps:

Register the Secure FTD with Secure FMC.

Change the firewall mode.

Deregister the Secure FTD device from Secure FMC.

To perform these actions, accessing the Secure FTD CLI from the console port is necessary. This allows the engineer to execute the required commands to change the firewall mode and manage the registration status of the FTD device.

Steps:

Connect to the Secure FTD device via the console port.

Access the CLI and execute the command to change the firewall mode (configure firewall-mode).

Deregister the device from FMC if needed.

Register or re-register the device with FMC as required.

To connect to a Secure Endpoint private cloud instance from Cisco Secure Firewall Management Center (FMC), the network engineer requires the SSL certificate for the Secure Endpoint private cloud instance. This SSL certificate is necessary to establish a secure, trusted connection between the FMC and the private cloud instance.

Steps:

Obtain the SSL certificate from the server administrator.

Import the SSL certificate into the FMC.

Configure the connection to the Secure Endpoint private cloud instance using the provided hostname and SSL certificate.

This ensures a secure and authenticated connection to the private cloud instance.

The show bgp neighbors NEIGHBOR-IP advertised-routes command displays the prefixes that the Secure Firewall Threat Defense device is advertising to a specific BGP neighbor. It must be executed against the managed threat defense device through the Advanced Troubleshooting interface. The ordinary show route command displays routes installed in the local routing table, not the specific prefixes advertised to a neighbor. Route injection is a configuration capability and does not provide the required verification output. Cisco’s command reference confirms that the advertised-routes keyword displays all routes advertised to the specified BGP peer, including the network, next hop, metric, weight, and AS path. Therefore, option A directly verifies the routes being shared with the upstream router. Cisco Secure Firewall Threat Defense Command Reference

================

The Cisco Threat Response browser plugin provides contextual investigation capabilities that can be launched from Secure Firewall Management Center. It allows an administrator to investigate an observable, such as a suspicious IP address, against Cisco threat-intelligence and integrated security sources without manually transferring the value to another interface. Secure Network Analytics analyzes network telemetry and behavior but is not the browser-based lookup mechanism described. Cisco ISE supplies identity, authorization, and network-access context, while Secure Endpoint provides endpoint telemetry and file or process investigation. Neither is the direct web-page investigation tool requested. Cisco documentation describes contextual cross-launch functionality for looking up suspicious source addresses in Cisco or third-party cloud-hosted intelligence services. Therefore, the Threat Response browser plugin is the correct selection. Cisco event investigation using web resources

================

When capturing traffic on a Cisco FTD device to troubleshoot a connectivity problem, a file type that can be exported for reviewing using a tool built for this type of analysis is PCAP. PCAP stands for Packet Capture and it is a file format used to store network packet data captured from anetwork interface8. PCAP files contain the raw data of network packets, including the headers and payloads of each packet8.

PCAP files are widely used in network analysis and troubleshooting tasks. They enable network administrators, analysts, and researchers to inspect and analyze network traffic for various purposes, such as diagnosing network issues, detecting malicious activity, measuring network performance, and understanding network protocols8. PCAP files can be read by applications that understand that format, such as Wireshark, tcpdump, CA NetMaster, or Microsoft Network Monitor8.

The other options are incorrect because:

NetFlow v9 is not a file type, but a protocol for collecting and exporting information about network flows. A network flow is a sequence of packets that share common attributes such as source and destination IP addresses, ports, and protocols9. NetFlow v9 records contain summary information about network flows, such as start and end times, byte counts, packet counts, and so on9. NetFlow v9 records do not contain the raw data of network packets.

NetFlow v5 is not a file type, but an earlier version of the NetFlow protocol for collecting and exporting information about network flows. NetFlow v5 records contain similar information as NetFlow v9 records, but with fewer fields and less flexibility10. NetFlow v5 records do not contain the raw data of network packets.

IPFIX is not a file type, but a protocol for collecting and exporting information about network flows. IPFIX stands for IP Flow Information Export and it is based on NetFlow v9, but with some extensions and improvements11. IPFIX records contain similar information as NetFlow v9 records, but with more fields and more flexibility11. IPFIX records do not contain the raw data of network packets.

Cisco Defense Orchestrator (CDO) is the tool that assists engineers in performing an audit of network projects to determine which objects are duplicated across various firewall models, including Cisco Secure Firewall Threat Defense, Cisco Secure Firewall ASA, and Meraki MX Series. CDO provides a unified management interface for managing multiple security devices and can identify duplicate objects across these devices.

Steps:

Access Cisco Defense Orchestrator.

Connect and synchronize all relevant firewall devices (FTD, ASA, Meraki MX).

Use the audit and reporting features in CDO to identify and manage duplicate objects.

This helps ensure consistency and efficient management across the organization ' s firewall deployments.

To enable Cisco Secure Firewall Malware Defense to detect and block malware, the network administrator must associate a File policy with an access control policy. File policies allow administrators to configure malware detection and file analysis capabilities on the Cisco Secure Firewall Threat Defense appliance.

Steps to configure File policy:

Navigate toPolicies > Access Control > File Policiesin the FMC.

Create a new file policy or edit an existing one to include malware detection and blocking settings.

Associate the file policy with the relevant access control policy.

Ensure that the access control policy is deployed to the FTD appliance.

By associating a file policy, the firewall will inspect files being transmitted through the web server for malware and take appropriate actions (block, allow, or alert) based on the configured rules.

The intended control node should be assigned a numerically lower priority value than the other cluster nodes. Cisco Secure Firewall cluster priority values operate inversely: the lowest numerical value represents the highest election priority. For example, a node configured with priority 1 takes precedence over nodes configured with priorities 10 or 20. If the current control node fails, the available node with the highest priority—meaning the lowest configured number—is elected as the replacement. Values 0 and 255 are outside the documented 1–100 range for this Management Center clustering implementation. Therefore, the node with greater processing resources should receive a lower numerical value. The supplied answer of C in List B is incorrect and has been corrected to B based on Cisco documentation. Cisco Secure Firewall clustering documentation

================

Step 1(Configure the primary unit for high availability),

Step 2(Configure the secondary unit for high availability),

Step 3(Configure the two units for high availability),

Step 4(Configure failover criteria for health monitoring)

The correct sequence of actions for configuring a multi-instance environment for high availability on a Cisco Firepower 4100 appliance is as follows:

Add a resource profile for container instances. A resource profile defines the CPU, RAM, and disk space allocation for each container instance.You can create multiple resource profiles with different resource settings and assign them to different container instances1.

Add a MAC pool prefix and view the MAC address for the container instance interfaces. A MAC pool prefix is a 24-bit prefix that is used to generate MAC addresses for the container instance interfaces. You can specify a custom MAC pool prefix or use the default one.You can also view the MAC addresses that are assigned to each container instance interface1.

Configure interfaces. You need to configure the physical interfaces, EtherChannels, and VLAN subinterfaces that will be used by the container instances.You can also configure shared interfaces that can be used by multiple container instances on the same security module/engine1.

Add a Standalone Firepower Threat Defense for Cisco Secure Firewall Management Center. You need to add a logical device that runs a standalone Firepower ThreatDefense (FTD) application instance and register it with the Cisco Secure Firewall Management Center (FMC).This logical device will act as the management interface for the container instances1.

Add a high-availability pair. You need to add another logical device that runs a standalone FTD application instance and register it with the FMC as well. Then, you need to configure high availability (HA) between the two standalone FTD logical devices.This will enable HA for the container instances that are associated with them1.

Transparent firewall mode forwards traffic at Layer 2, so the participating physical interfaces must be assigned to at least one bridge group. This allows the device to inspect traffic while remaining logically transparent to the connected switch stacks. Bridge Protocol Data Units should also be exempted from advanced inspection. BPDUs are essential for spanning-tree operation, and delaying or blocking them during inspection restarts can produce topology instability or an interruption. A BVI provides Layer 3 addressing for device-originated traffic or management but is not inherently required merely to inspect transit traffic. Jumbo-frame configuration is unnecessary unless the network explicitly uses jumbo frames, and separate data and management routes do not establish transparent forwarding. Cisco specifically recommends using an EtherType ACL to trust BPDUs on each bridge-group member interface. Cisco transparent firewall configuration

================

In a failover configuration with Cisco Secure Firewall Threat Defense (FTD) devices, ensuring that users on the internal network can continue to communicate with outside devices if the primary device (FTD1) fails requires the implementation of a stateful failover link. The stateful failover link allows the secondary device (FTD2) to maintain session information and state data, ensuring seamless failover and minimizing disruptions.

Steps to implement a stateful failover link:

Physically connect a stateful failover link between FTD1 and FTD2.

Configure the stateful failover link in the FMC.

Ensure that both devices are properly synchronized and that stateful failover is enabled.

Deploy the changes to both FTD devices.

By configuring a stateful link, the secondary FTD can take over active sessions without requiring users to re-establish their connections, thus ensuring continuous communication.

The Analysis > Hosts > Vulnerabilities page in Cisco FMC displays information about the hosts on the network and their associated vulnerabilities. The administrator can filter the hosts by impact level, which indicates how likely an attack is to succeed against a host. An impact level of 2 means that the host was attacked and is potentially vulnerable, but no exploit was confirmed. The administrator can click on a host to view more details, such as its IP address, operating system, applications, protocols, and intrusionevents. The administrator can also view the details of each vulnerability, such as its CVE ID, description, severity, and recommended actions3

When configuring a custom widget on a dashboard within Cisco Secure Firewall Management Center (FMC), it is mandatory to provide a title for the system to display the information correctly. The title helps in identifying and organizing the widget on the dashboard.

Steps:

Navigate to the dashboard section in FMC.

Add a new custom widget.

Configure the widget settings and provide a title.

Save and apply the widget to the dashboard.

Providing a title ensures that the widget is correctly displayed and easily identifiable on the dashboard.

The casebook and pivot menu are widgets available in Cisco Threat Response. Casebook - It is used to record, organize, and share sets of observables of interest primarily during an investigation and threat analysis. You can use a casebook to get the current verdicts or dispositions on the observables.

https://www.cisco.com/c/en/us/td/docs/security/ces/user_guide/esa_user_guide_13-5-1/b_ESA_Admin_Guide_ces_13-5-1/b_ESA_Admin_Guide_13-0_chapter_0110001.pdf

Threat Intelligence Director cannot apply Block directly to a TAXII source because STIX data obtained through TAXII can contain complex indicators. A managed device takes enforcement action based on individual observables, such as an IP address, URL, domain, or file hash. After the TAXII content has been ingested, an administrator can configure Block on an individual observable or on a simple indicator containing one actionable observable. Complex indicators combine multiple observables and therefore cannot be blocked directly; the administrator must instead block the appropriate individual observables within them. An element is the managed device that receives published intelligence, not an intelligence object on which this action is configured. Consequently, the two supported object types are an observable and a simple indicator. Cisco Threat Intelligence Director documentation

================

To streamline the process of reviewing events and modifying blocking of specific files across both the firewall console and the endpoint console, the security engineer should initiate the integration between Secure FMC and Cisco Secure Endpoint (formerly AMP for Endpoints) from the Secure FMC using the AMP tab.

Steps:

In the FMC, navigate toDevices > Device Management.

Select the device and go to theAMPtab.

Initiate the integration by configuring the necessary API credentials and linking the FMC to the Cisco Secure Endpoint console.

This integration allows the security engineer to view endpoint events and apply blocking actions directly from the FMC, consolidating the management tasks.

This approach simplifies the workflow by providing a single interface to manage both network and endpoint security, reducing the time and effort required to maintain security across the organization.

To perform rapid threat containment with Cisco FMC, the necessary component is Cisco Identity Services Engine (ISE). ISE integrates with FMC to provide dynamic network access control and enforcement, allowing for quick isolation of compromised endpoints based on security events detected by FMC.

Steps:

Integrate FMC with ISE by configuring the necessary settings in both platforms.

Define security policies in FMC that trigger rapid threat containment actions via ISE.

When a threat is detected, FMC can instruct ISE to isolate the affected endpoint, limiting its access to the network.

This integration enables automated and efficient threat containment, reducing the response time and mitigating the impact of security incidents.

The Untrusted reputation level represents URLs associated with malicious, undesirable, or demonstrably unsafe behavior and is therefore the appropriate selection for the access control rule. Questionable applies to URLs that exhibit suspicious characteristics but lack sufficient evidence to be classified as definitively malicious. Neutral identifies sites without a strong positive or negative reputation, while Favorable indicates generally acceptable sites with a positive reputation history. Secure Firewall Management Center combines URL categories with reputation values to provide more precise web-control decisions. Selecting Untrusted enables the rule to match the highest-risk URLs covered by the requirement without unnecessarily treating merely unknown or neutral sites as confirmed threats. Cisco documents URL reputation as the risk component used with URL categories in category-and-reputation-based filtering. Cisco Secure Firewall URL filtering

================

When an FTD device that is managed by FDM is registered to FMC, the existing configuration is automatically converted and imported into FMC. The FMC then pushes the configuration back to the device. This process preserves most of the FDM configuration, except for some features that are not supported by FMC, such as VPN wizards and certificates.

Change Reconciliation records snapshots whenever users save system-configuration changes and combines those snapshots into a detailed report covering the previous 24 hours. Under System > Configuration > Change Reconciliation, the administrator enables the feature, selects the daily execution time, and specifies management’s recipient email addresses. The administrator can also include policy-configuration changes and enable the full change history instead of receiving only a consolidated view. An email relay host must be configured so that Management Center can deliver the report. Sending audit logs to an HTTP or syslog server streams audit events to an external collector; it does not generate the required daily email summary. STIG Compliance applies security-hardening settings and is unrelated to scheduled change reporting. Cisco Change Reconciliation documentation

The Encrypted Visibility Engine (EVE) in Cisco Secure Firewall Management Center is enabled under the SSL tab of an access control policy. EVE provides visibility into encrypted traffic, allowing the firewall to detect threats even when traffic is encrypted.

Steps to enable EVE:

Navigate to the access control policy in FMC.

Go to theSSLtab.

Enable Encrypted Visibility Engine (EVE) to analyze encrypted traffic.

This configuration helps in identifying and mitigating threats within encrypted traffic without the need for full decryption.

In a local SPAN configuration, the source is the switch interface whose traffic must be copied, while the destination is the interface connected to the passive monitoring device. Therefore, switch interface Gi0/1 must be configured as the SPAN source, and switch interface Gi0/3, which connects to the Cisco Secure IPS sensor, must be the destination. Both commands must also reference the same SPAN session number. Option D satisfies all these requirements. Options B and C omit the mandatory session number, while Option A incorrectly assigns Gi0/3 as both the source and destination. A SPAN destination cannot simultaneously be a source in the same session. The passive IPS receives the mirrored packets for inspection but does not retransmit or directly block them. Cisco SPAN configuration documentation