FirePower Access Control: Allow Traffic Without Inspection

350-701 By islever Editorial Last updated

Implement access control policies, AVC, URL filtering, malware protection, and intrusion prevention using Cisco Secure Firewall (FTD)

Short answer

DE Select 'trust' and 'monitor' actions to allow traffic to pass without inspection for a new application.

Question

A Cisco FirePower administrator needs to configure a rule to allow a new application that has never been seen on the network. Which two actions should be
selected to allow the traffic to pass without inspection? (Choose two.)
  1. permit
  2. allow
  3. reset
  4. trust Correct Answer
  5. monitor Correct Answer

Key Takeaways

The key trap is confusing 'allow' with 'permit' or assuming a single action suffices; the exam tests the specific combination of 'trust' and 'monitor' for bypassing inspection on new apps.

This question addresses how to configure Cisco FirePower (FTD) access control rules for unknown applications. The correct configuration uses 'trust' and 'monitor' actions to allow traffic while logging it without deep inspection.

Common mistake: Many candidates select 'permit' or 'allow', failing to realize that 'permit' is not a valid action in FTD access control rules, and 'allow' alone might still trigger some inspection depending on policy context, whereas 'trust' explicitly skips it.

Expert Analysis

Why the Answer Is Correct

In Cisco Firepower Threat Defense (FTD), the Access Control policy does not use a 'permit' action; instead, it uses 'allow'. However, the question asks for two actions to allow traffic without inspection for a new application. The specific actions designed for this purpose are 'monitor' and 'trust'. A 'monitor' rule logs traffic without blocking it, allowing the system to learn about the application. A 'trust' rule allows traffic to pass without further inspection (like IPS or malware scanning). Combining these ensures the traffic flows but is tracked and trusted.

Why the Other Options Are Wrong

'Permit' (A) is not a valid action type in FTD Access Control rules; the equivalent is 'allow'. 'Allow' (B) is a valid action, but selecting 'allow' and 'trust' would be redundant or incorrect because 'trust' implies allowing. 'Reset' (C) drops the connection and sends resets, which blocks traffic rather than allowing it. 'Monitor' (E) alone logs but doesn't explicitly 'trust' the traffic against all future inspections in the same definitive way 'trust' does for known good patterns, though they are often used together. The question specifically targets the 'trust' mechanism for bypassing inspection.

Community Comment Notes

Community consensus strongly supports D and E. As user rad9899 noted, 'trust' and 'monitor' are the correct pair. User west33637 explained that you create a monitor rule first, then a trust rule below it. User Dinges highlighted that 'allow' and 'trust' would conflict, whereas 'monitor' and 'trust' work sequentially. User Jayde provided an official Cisco link confirming that 'trust' evaluates traffic next, allowing it to pass without further inspection.

Official Reference

https://www.cisco.com/c/en/us/td/docs/security/firepower/610/configuration/guide/fpmc-config-guide-v61/access_control_rules.html#ID-2190-00000005

This link opens the official vendor documentation in a new tab.

Exam Strategy

Remember that FTD Access Control rules use 'allow', 'deny', 'monitor', and 'trust'. Never confuse 'permit' (ASA syntax) with 'allow' (FTD syntax). For 'no inspection' scenarios, 'trust' is the keyword.

Frequently Asked Questions

Why is 'permit' not an option in FirePower?

Firepower uses 'allow' instead of 'permit' which is found in traditional ASA CLI configurations.

What is the difference between 'allow' and 'trust'?

'Trust' allows traffic without any further security inspection (IPS, Malware), while 'allow' may still trigger some checks depending on other policies.

More 350-701 FAQ →

Discussion 47 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 47

  1. rad9899 👍 32
    D. trust E. monitor
  2. loiphin 👍 12
    In case you are still nervy about the above answers, then this diagram will calm your nerves :) https://www.cisco.com/c/en/us/td/docs/security/firepower/610/configuration/guide/fpmc-config-guide-v61/access_control_rules.html#ID-2190-00000005
  3. west33637 👍 6
    create a monitor rule that matches the application. Then create a trust rule right below it.
  4. Dinges 👍 5
    either allow OR trust rule will trigger. Traffic will never hit both rules, so no point in configuring them both. ONLY with monitor rule first, will the traffic hit the second rule which is allow or trust: in this case it must be trust. so D and E are correct
  5. Jayde 👍 4
    D & E Rule 1: Monitor evaluates traffic first. Monitor rules track and log network traffic. The system continues to match traffic against additional rules to determine whether to permit or deny it. (However, see an important exception and caveat at Access Control Rule Monitor Action.) Rule 2: Trust evaluates traffic next. Matching traffic is allowed to pass to its destination without further inspection, though it is still subject to identity requirements and rate limiting. Traffic that does not match continues to the next rule. Rule 3: Block evaluates traffic third. Matching traffic is blocked without further inspection. Traffic that does not match continues to the final rule. Rule 4: Allow is the final rule. For this rule, matching traffic is allowed; however, prohibited files, malware, intrusions, and exploits within that traffic are detected and blocked. Remaining non-prohibited, non-malicious traffic is allowed to its destination, though it is still subject to identity requirements and rate limiting. You can configure Allow rules that perform only file inspection, or only intrusion inspection, or neither.
Show 25 more comments
  1. Reece_S 👍 4
    Allow & Trust is the answer. Allowed applications are inspected only if there is a policy for it. If this it new unknown application, there is probably no policy so its allowed and not inspected. There is a diagram at the bottom of this page the shows when inspections occur for Allowed applications traffic. https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/access_control_rules.html#ID-2190-0000023b
  2. Ludwig31 👍 4
    https://www.cisco.com/c/en/us/td/docs/security/firepower/610/configuration/guide/fpmc-config-guide-v61/access_control_rules.html D and E
  3. pr0fectus 👍 4
    Key term is "pass without inspection"
  4. rbrain 👍 4
    Trust & Monitor
  5. klu16 👍 3
    There are seven different actions which a rule can use: - Allow – Allows traffic. There may yet be more inspections, such as Intrusion and File policies - Trust – Sends traffic straight to the egress interface, without any extra inspections. Identity policies and rate limiting still apply - Monitor – Logs traffic, and continues to the rest of the rules - Block – Drops traffic silently, causing the connection to timeout - Block with reset – Drops traffic, and sends a TCP FIN, so the connection closes rather than times out - ​Interactive Block – Displays a web page with conditions that users may accept. This is where the Interactive Block Response Page comes into play - ​​Interactive Block with Reset – Combination of interactive block, with a TCP FIN Therefore answers should be D & E in my opinion.
  6. zeroC00L 👍 3
    odd question... from the given options i would opt for B and D. A: is not a valid option from FMC GUI Access Control Policy perspective B: is a valid option and advanced inspections (IPS/AMP/URL) are optional you dont have to use them hence you can use allow without them. C: is a option for the block action D: Trust is a valid option, if you choose this you even cant enable the advanced inspections E: this is not passing traffic. If you set a policy to monitor and if traffic is not hitting the monitor policy it will be evaluated against the other entries. so if you want to be 100% sure you pass the traffic without inspection this is not the right option.
  7. Fugashi 👍 3
    https://www.cisco.com/c/en/us/td/docs/security/firepower/610/configuration/guide/fpmc-config-guide-v61/access_control_rules.html?bookSearch=true#ID-2190-0000023b There is an exception, however. If a Monitor rule contains layer 7 conditions—such as an application condition—the system allows early packets to pass and the connection to be established (or the SSL handshake to complete)
  8. wfexco 👍 3
    Should be D and E. - Monitor matches the criteria to see if the rule is set up correctly, without actually performing any action on the rule match.
  9. jshow 👍 3
    It cannot be E. questions states without inspection. Monitor inspects the traffic So B & D for me
  10. efongvan 👍 3
    Trust and Monitor.
  11. SomKeat 👍 2
    B & D is correct Trust: This action allows traffic to pass without any further inspection, though it is still subject to identity requirements and rate limiting. Trusted traffic bypasses network discovery, intrusion inspection, and malware inspection. Allow: This action allows traffic to pass but still subjects it to optional deep inspection such as intrusion and file policies. However, if the goal is to allow traffic without inspection, "Trust" is the more direct choice. "Allow" permits traffic but can include inspection if configured.
  12. aaInman 👍 2
    Allow -OR- Trust. When doing this in real life, there is a drop-down menu that will allow you to select Allow or Trust, can use both. Allow, allows traffic with inspection while Trust allows traffic to just pass without inspection. D and E seem appropriate in this scenerio
  13. bobie 👍 2
    The allow action, If it does only file inspection, intrusion inspection, or neither, it signifies that it will not be inspected because the application is unknown. Without a doubt, the trust action is one of the proper answers.
  14. hisho72 👍 2
    "that has never been seen on the network " it seems to me like TEST , and this match with Monitor action which does not need to inspection , Allow match pass with "inspection" while Trust without . so it is : B and E
  15. psuoh 👍 2
    The system does not perform deep inspection on trusted, blocked, or encrypted traffic. You monitor to log the session to use when "configuring a rule to allow a new application..."
  16. hisho72 👍 2
    "that has never been seen on the network " it seems to me like TEST , and this match with Monitor action , Allow match pass with "inspection" while Trust without .
  17. breezer 👍 2
    Dont put too much strain in the question.. Monitor action is only used to log traffic.. it in itself cannot allow or block.. Answer is Allow and Trust
  18. YooAndI 👍 2
    Step 1: Monitor Step 2: Trust --> No inspection --> Reaches Destination Allow is further down on the process, Step 4, after Step 3: Block.
  19. klu16 👍 2
    Yeah. Question states "WITHOUT INSPECTION". Monitor does not inspect traffic, just tracks and logs it. So D & E for me as well.
  20. Basuso 👍 2
    It's Trust & Monitor. Trust applies fast-path to traffic, and Monitor only Logs the traffic. Allow will inspect traffic.
  21. entitty 👍 2
    B&D - Allow and Trust - You want the traffic to pass without inspection (monitor)
  22. rbrain 👍 2
    D&E ofcourse
  23. zheka 👍 1
    My concern is about the wording in the question. Is it should or could ? The point is that you can't have two actions in one rule. So, if you create a rule then you select one action. If you select Monitor and it is for an application then you hit an exception: If a Monitor rule contains layer 7 conditions—such as an application condition—the system allows early packets to pass and the connection to be established (or the SSL handshake to complete). This occurs even if the connection should be blocked by a subsequent rule To make the traffic from this application go without any inspection we select Trust action but it should be the second rule. With Allow action you still can drop the traffic by IPS j or AMP engine. So Trust is for sure but having them with Monitor requires two rules
  24. Ernestokoro 👍 1
    in Cisco Firepower, the "Trust" condition in an Access Control Policy does not inspect traffic for intrusions or files; it allows the traffic to pass to its destination without further deep inspection. However, it is still subject to certain operations like identity requirements, rate limiting, and pre-defined SSL decryption, as these happen before the access control policy evaluation No, a Cisco Firepower "monitor" condition itself does not inspect traffic; its primary purpose is to log and track network traffic for later analysis without taking action to permit or deny it. The actual deep inspection of the traffic, such as for intrusions or malware, happens when traffic matches a separate Intrusion or File policy.
  25. birdman6709 👍 1
    Rule 1: Monitor evaluates traffic first. Monitor rules track and log network traffic. The system continues to match traffic against additional rules to determine whether to permit or deny it. (However, see an important exception and caveat at Access Control Rule Monitor Action.) Rule 2: Trust evaluates traffic next. Matching traffic is allowed to pass to its destination without further inspection, though it is still subject to identity requirements and rate limiting. Traffic that does not match continues to the next rule.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is a Feature of an Endpoint Detection and Response Solution?

S-grade

Which Two Methods Belong in an AAA Authentication Method List?

S-grade

Preventing Unauthorized DHCP Servers on Cisco Switches

S-grade

What Is Considered a Cloud Data Breach in Cisco 350-701?

S-grade

← Back to 350-701 Study Guide