Which Cisco IPS Mode Monitors Traffic Without Affecting Flows?

300-710 By islever Editorial Last updated

Implement NGIPS modes

Short answer

C Deploy the Cisco IPS appliance in promiscuous mode so it inspects a copy of the traffic and baselines unwanted activity without affecting flows.

Question

A network administrator is deploying a Cisco IPS appliance and needs it to operate initially without affecting traffic flows. It must also collect data to provide a baseline of unwanted traffic before being reconfigured to drop it. Which Cisco IPS mode meets these requirements?
  1. failsafe
  2. inline tap
  3. promiscuous Correct Answer
  4. bypass

Key Takeaways

The question tests Cisco IPS sensor deployment modes, and the trap is confusing monitor-only promiscuous mode with inline tap or bypass, which keep the sensor in the live packet path.

A Cisco IPS appliance must inspect live traffic without impacting flows while it builds a baseline of unwanted activity for later enforcement. Promiscuous mode (C) is the monitor-only deployment that meets both requirements, with inline enforcement configured afterwards.

Common mistake: Picking inline tap (B) because it also inspects a copy without dropping; learners assume only an inline pair can later enforce drop actions, but the requirement to run initially with zero traffic impact is the promiscuous monitoring use case.

Expert Analysis

Why the Answer Is Correct

Promiscuous mode is the Cisco IPS sensor deployment in which the appliance receives a copy of the traffic (typically via SPAN or a VACL capture) and never sits in the forwarding path, so production packets flow untouched while the sensor builds events and a baseline of unwanted traffic. The stem's two conditions line up exactly with that behavior: "operate initially without affecting traffic flows" and "collect data to provide a baseline of unwanted traffic." The trailing phrase "before being reconfigured to drop it" describes the normal lifecycle step of reconfiguring the now-baselined sensor into an inline interface or inline VLAN pair so drop actions take effect. Option C is therefore the mode that satisfies both the monitoring and the future-enforcement requirement.

Why the Other Options Are Wrong

Option A, failsafe, is not a monitoring mode at all; it defines how the sensor behaves when it fails (fail-open or fail-closed), so it says nothing about baselining traffic. Option B, inline tap, does inspect a copy and forwards the original packet unchanged, but it is still an inline deployment: the sensor is physically inserted into the live path, which contradicts the wording that the appliance should run initially without affecting flows and will be reconfigured later. Option D, bypass, describes hardware bypass/interface-pair behavior that keeps traffic flowing when the sensor loses power or fails, a resiliency feature rather than a data-collection mode. Only promiscuous mode is documented as the monitor-only deployment used to characterize traffic before enforcement.

Community Comment Notes

Several participants land on C, including Joe_Blue, who states that "The promiscuous mode of the Cisco IPS meets these requirements," and Dolby58, who flatly posts "C is correct!" after first questioning the terminology. The inline tap camp is led by Initial14 and donciga, the latter arguing that "Inline tap puts the IPS in the live path but inspects a copy of each packet" and that promiscuous would require re-cabling later. SegaMasterSystemAdmin cuts through the confusion by pointing out "This is talking about a Cisco IPS appliance and not a FTD," which supports the classic promiscuous-mode answer, while achille5 and bobie both cite the Cisco IPS CLI interface configuration guide as their source.

Official Reference

https://www.cisco.com/en/US/docs/security/ips/5.0/configuration/guide/cli/cliinter.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a stem says the sensor must not affect traffic "initially" or "before being reconfigured," map that to monitor-only promiscuous mode, because drop actions require a later move to an inline pair. Also match the platform named in the stem: a Cisco IPS appliance (not FTD) points to the classic promiscuous versus inline mode pair.

Frequently Asked Questions

Why isn't inline tap (B) the right Cisco IPS mode for this scenario?

Inline tap still places the sensor in the live packet path; Cisco's documented monitor-only deployment for collecting baseline data with no traffic impact is promiscuous mode.

Does moving from promiscuous monitoring to dropping traffic require re-cabling?

Yes. Enforcement requires reconfiguring the sensor into an inline interface or inline VLAN pair, which is why the stem says the appliance will be reconfigured to drop later.

More 300-710 FAQ →

Discussion 13 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 13

  1. Initial14 👍 9 Answered B
    The question states: A network administrator is deploying a Cisco IPS appliance and needs it to operate initially without affecting traffic flows. IT NEEDS TO OPERATE INITIALY, meaning inline tap, because in the future, we willgo from not affecting traffic, to activating IPS. if you use passive deployment, meaning you copy data to IPS in the future you can't implement IPS rule blocking. For me It's B
  2. Dolby58 👍 3 Answered B
    B is correct. Promiscuous mode doesn't exist.
  3. Joe_Blue 👍 2 Answered C
    The promiscuous mode of the Cisco IPS meets these requirements. It can be configured to operate initially without affecting traffic flows and collects data to provide a baseline of unwanted traffic before being reconfigured to drop it. In promiscuous mode, the IPS is configured to monitor traffic only and does not affect the flow of packets.
  4. achille5 👍 2 Answered C
    https://www.cisco.com/en/US/docs/security/ips/5.0/configuration/guide/cli/cliinter.html#wp1033759
  5. SegaMasterSystemAdmin 👍 2 Answered C
    This is talking about a Cisco IPS appliance and not a FTD so leaning towards promiscuous mode
Show 8 more comments
  1. Dolby58 👍 2 Answered C
    C is correct!
  2. donciga 👍 1 Answered B
    Inline tap puts the IPS in the live path but inspects a copy of each packet and forwards the original unchanged. You get a baseline of what would have been dropped, with no impact on flows. When you are ready to enforce, you turn tap off—same cables, same inline pair—and drop actions take effect. Promiscuous (SPAN) also does not affect traffic, but moving from that to dropping requires recabling into inline. Failsafe and bypass are failure behaviors, not a baseline/tuning mode.
  3. Dolby58 👍 1
    I stand corrected. It's not B. The question is about Cisco IPS which has three modes: Promiscuous, Inline and Bypass. So C is correct. https://www.cisco.com/en/US/docs/security/ips/5.0/configuration/guide/cli/cliinter.html#wp1033938
  4. ureis 👍 1
    "It must also collect data" meaning copy the data, only tap mode copy data without affect the network
  5. bobie 👍 1 Answered C
    https://www.cisco.com/en/US/docs/security/ips/5.0/configuration/guide/cli/cliinter.html#wp1033699
  6. ureis 👍 1
    OBS: TAP cant drop packets, so C is correct
  7. ureis 👍 1
    Promiscuous = Transparent Mode
  8. aaInman 👍 1 Answered C
    I believe C as well.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Changing FTD from Routed to Transparent Mode

S-grade

How Do You Isolate BVI Traffic on a Routed FTD?

S-grade

Cisco FTDv Licensing Model Valid Statements

S-grade

Duo and RTC for FTD Remote Access VPN

S-grade

← Back to 300-710 Study Guide