Which Cisco IPS Mode Monitors Traffic Without Affecting Flows?
A network administrator is deploying a Cisco IPS appliance and needs it to operate initially without affecting traffic flows. It must also collect data to provide a baseline of unwanted traffic before being reconfigured to drop it. Which Cisco IPS mode meets these requirements?
Community Insight
The question tests Cisco IPS sensor deployment modes, and the trap is confusing monitor-only promiscuous mode with inline tap or bypass, which keep the sensor in the live packet path.
A Cisco IPS appliance must inspect live traffic without impacting flows while it builds a baseline of unwanted activity for later enforcement. Promiscuous mode (C) is the monitor-only deployment that meets both requirements, with inline enforcement configured afterwards.
Picking inline tap (B) because it also inspects a copy without dropping; learners assume only an inline pair can later enforce drop actions, but the requirement to run initially with zero traffic impact is the promiscuous monitoring use case.
Community Discussion (13 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Promiscuous mode is the Cisco IPS sensor deployment in which the appliance receives a copy of the traffic (typically via SPAN or a VACL capture) and never sits in the forwarding path, so production packets flow untouched while the sensor builds events and a baseline of unwanted traffic. The stem's two conditions line up exactly with that behavior: "operate initially without affecting traffic flows" and "collect data to provide a baseline of unwanted traffic." The trailing phrase "before being reconfigured to drop it" describes the normal lifecycle step of reconfiguring the now-baselined sensor into an inline interface or inline VLAN pair so drop actions take effect. Option C is therefore the mode that satisfies both the monitoring and the future-enforcement requirement.Why the Other Options Are Wrong
Option A, failsafe, is not a monitoring mode at all; it defines how the sensor behaves when it fails (fail-open or fail-closed), so it says nothing about baselining traffic. Option B, inline tap, does inspect a copy and forwards the original packet unchanged, but it is still an inline deployment: the sensor is physically inserted into the live path, which contradicts the wording that the appliance should run initially without affecting flows and will be reconfigured later. Option D, bypass, describes hardware bypass/interface-pair behavior that keeps traffic flowing when the sensor loses power or fails, a resiliency feature rather than a data-collection mode. Only promiscuous mode is documented as the monitor-only deployment used to characterize traffic before enforcement.Community Comment Notes
Several participants land on C, including Joe_Blue, who states that "The promiscuous mode of the Cisco IPS meets these requirements," and Dolby58, who flatly posts "C is correct!" after first questioning the terminology. The inline tap camp is led by Initial14 and donciga, the latter arguing that "Inline tap puts the IPS in the live path but inspects a copy of each packet" and that promiscuous would require re-cabling later. SegaMasterSystemAdmin cuts through the confusion by pointing out "This is talking about a Cisco IPS appliance and not a FTD," which supports the classic promiscuous-mode answer, while achille5 and bobie both cite the Cisco IPS CLI interface configuration guide as their source.Official Reference
Exam Strategy
When a stem says the sensor must not affect traffic "initially" or "before being reconfigured," map that to monitor-only promiscuous mode, because drop actions require a later move to an inline pair. Also match the platform named in the stem: a Cisco IPS appliance (not FTD) points to the classic promiscuous versus inline mode pair.
Frequently Asked Questions
Why isn't inline tap (B) the right Cisco IPS mode for this scenario?
Inline tap still places the sensor in the live packet path; Cisco's documented monitor-only deployment for collecting baseline data with no traffic impact is promiscuous mode.
Does moving from promiscuous monitoring to dropping traffic require re-cabling?
Yes. Enforcement requires reconfiguring the sensor into an inline interface or inline VLAN pair, which is why the stem says the appliance will be reconfigured to drop later.