FirePower Access Control: Allow Traffic Without Inspection
Implement access control policies, AVC, URL filtering, malware protection, and intrusion prevention using Cisco Secure Firewall (FTD)
Answer
Correct answer: D, E — Select 'trust' and 'monitor' actions to allow traffic to pass without inspection for a new application.
A Cisco FirePower administrator needs to configure a rule to allow a new application that has never been seen on the network. Which two actions should be selected to allow the traffic to pass without inspection? (Choose two.)
Community Insight
The key trap is confusing 'allow' with 'permit' or assuming a single action suffices; the exam tests the specific combination of 'trust' and 'monitor' for bypassing inspection on new apps.
This question addresses how to configure Cisco FirePower (FTD) access control rules for unknown applications. The correct configuration uses 'trust' and 'monitor' actions to allow traffic while logging it without deep inspection.
Many candidates select 'permit' or 'allow', failing to realize that 'permit' is not a valid action in FTD access control rules, and 'allow' alone might still trigger some inspection depending on policy context, whereas 'trust' explicitly skips it.
Community Discussion (47 comments)
shadowhunter_95
👍 1
Selected: DE
Allow will inspect traffic, monitor will only send things to ACP and trust will bypass inspection
SomKeat
👍 2
Selected: BD
B & D is correct Trust: This action allows traffic to pass without any further inspection, though it is still subject to identity requirements and rate limiting. Trusted traffic bypasses network discovery, intrusion inspection, and malware inspection. Allow: This action allows traffic to pass but still subjects it to optional deep inspection such as intrusion and file policies. However, if the goal is to allow traffic without inspection, "Trust" is the more direct choice. "Allow" permits traffic but can include inspection if configured.
ezpzls
👍 1
Selected: AB
You need to create the rule to allow (Permit) the traffic and also inspect it (Allow) smh..
Ernestokoro
👍 1
Selected: DE
in Cisco Firepower, the "Trust" condition in an Access Control Policy does not inspect traffic for intrusions or files; it allows the traffic to pass to its destination without further deep inspection. However, it is still subject to certain operations like identity requirements, rate limiting, and pre-defined SSL decryption, as these happen before the access control policy evaluation No, a Cisco Firepower "monitor" condition itself does not inspect traffic; its primary purpose is to log and track network traffic for later analysis without taking action to permit or deny it. The actual deep inspection of the traffic, such as for intrusions or malware, happens when traffic matches a separate Intrusion or File policy.
DANT7
👍 1
Selected: DE
In Cisco Firepower, "allow" passes traffic but still inspects it. "Trust" passes traffic without inspection. Since the question asks for allowing traffic without inspection, the correct answers are D. trust and E. monitor.
Diegosuarezb
👍 1
Selected: BD
B & D makes more sense to me
Basuso
👍 2
Selected: DE
It's Trust & Monitor. Trust applies fast-path to traffic, and Monitor only Logs the traffic. Allow will inspect traffic.
mhd96far
👍 1
Selected: DE
never seen on the network
Pakawat
👍 1
Selected: DE
Trust and Monitor
xziomal9
👍 1
Answer DE
HOUSSE
👍 1
TRUST AND MONITOR ALLOW IS NOT A GOOD ANSWER BECAUSE TRAFFIC WILL PASS UNDER INSPECTION
Pakawat
👍 1
Selected: DE
Trust and Monitor as the question mention that "without inspection".
F0rtyx40
👍 1
D and E , allow rules are still subject to L7 processing
bobie
👍 2
Selected: BD
The allow action, If it does only file inspection, intrusion inspection, or neither, it signifies that it will not be inspected because the application is unknown. Without a doubt, the trust action is one of the proper answers.
YooAndI
👍 2
Step 1: Monitor Step 2: Trust --> No inspection --> Reaches Destination Allow is further down on the process, Step 4, after Step 3: Block.
psuoh
👍 2
The system does not perform deep inspection on trusted, blocked, or encrypted traffic. You monitor to log the session to use when "configuring a rule to allow a new application..."
west33637
👍 6
Selected: DE
create a monitor rule that matches the application. Then create a trust rule right below it.
Emlia1
👍 1
D, E Explanation Each rule also has an action, which determines whether you monitor, trust, block, or allow matching traffic. Note: With action “trust”, Firepower does not do any more inspection on the traffic. There will be no intrusion protection and also no file-policy on this traffic.
dique
👍 1
D and E (Trust and monitor.)
otzu1
👍 1
D/E https://www.cisco.com/c/en/us/td/docs/security/firepower/610/configuration/guide/fpmc-config-guide-v61/access_control_rules.html
breezer
👍 2
Dont put too much strain in the question.. Monitor action is only used to log traffic.. it in itself cannot allow or block.. Answer is Allow and Trust
guest_user
👍 1
There is an exception, however. If a Monitor rule contains layer 7 conditions—such as an application condition—the system allows early packets to pass and the connection to be established (or the SSL handshake to complete). This occurs even if the connection should be blocked by a subsequent rule; this is because these early packets are not evaluated against subsequent rules.
rbrain
👍 4
Selected: BD
Trust & Monitor
rbrain
👍 2
D&E ofcourse
pr0fectus
👍 4
Selected: BD
Key term is "pass without inspection"
efongvan
👍 3
Trust and Monitor.
Fugashi
👍 3
https://www.cisco.com/c/en/us/td/docs/security/firepower/610/configuration/guide/fpmc-config-guide-v61/access_control_rules.html?bookSearch=true#ID-2190-0000023b There is an exception, however. If a Monitor rule contains layer 7 conditions—such as an application condition—the system allows early packets to pass and the connection to be established (or the SSL handshake to complete)
zheka
👍 1
My concern is about the wording in the question. Is it should or could ? The point is that you can't have two actions in one rule. So, if you create a rule then you select one action. If you select Monitor and it is for an application then you hit an exception: If a Monitor rule contains layer 7 conditions—such as an application condition—the system allows early packets to pass and the connection to be established (or the SSL handshake to complete). This occurs even if the connection should be blocked by a subsequent rule To make the traffic from this application go without any inspection we select Trust action but it should be the second rule. With Allow action you still can drop the traffic by IPS j or AMP engine. So Trust is for sure but having them with Monitor requires two rules
coentror
👍 1
Trust and monitor. Monitor traffic is the first action so logging is checked, after this trust policy so traffic reach destination without further inspections.
zeroC00L
👍 3
odd question... from the given options i would opt for B and D. A: is not a valid option from FMC GUI Access Control Policy perspective B: is a valid option and advanced inspections (IPS/AMP/URL) are optional you dont have to use them hence you can use allow without them. C: is a option for the block action D: Trust is a valid option, if you choose this you even cant enable the advanced inspections E: this is not passing traffic. If you set a policy to monitor and if traffic is not hitting the monitor policy it will be evaluated against the other entries. so if you want to be 100% sure you pass the traffic without inspection this is not the right option.
klu16
👍 3
There are seven different actions which a rule can use: - Allow – Allows traffic. There may yet be more inspections, such as Intrusion and File policies - Trust – Sends traffic straight to the egress interface, without any extra inspections. Identity policies and rate limiting still apply - Monitor – Logs traffic, and continues to the rest of the rules - Block – Drops traffic silently, causing the connection to timeout - Block with reset – Drops traffic, and sends a TCP FIN, so the connection closes rather than times out - Interactive Block – Displays a web page with conditions that users may accept. This is where the Interactive Block Response Page comes into play - Interactive Block with Reset – Combination of interactive block, with a TCP FIN Therefore answers should be D & E in my opinion.
Reece_S
👍 4
Allow & Trust is the answer. Allowed applications are inspected only if there is a policy for it. If this it new unknown application, there is probably no policy so its allowed and not inspected. There is a diagram at the bottom of this page the shows when inspections occur for Allowed applications traffic. https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/access_control_rules.html#ID-2190-0000023b
zap_pap
👍 1
Not E: Monitor will watch into the traffic and will pass it down the ACL. Traffic will be inspected by some other rule eventually.
jshow
👍 3
It cannot be E. questions states without inspection. Monitor inspects the traffic So B & D for me
Ludwig31
👍 4
https://www.cisco.com/c/en/us/td/docs/security/firepower/610/configuration/guide/fpmc-config-guide-v61/access_control_rules.html D and E
birdman6709
👍 1
Rule 1: Monitor evaluates traffic first. Monitor rules track and log network traffic. The system continues to match traffic against additional rules to determine whether to permit or deny it. (However, see an important exception and caveat at Access Control Rule Monitor Action.) Rule 2: Trust evaluates traffic next. Matching traffic is allowed to pass to its destination without further inspection, though it is still subject to identity requirements and rate limiting. Traffic that does not match continues to the next rule.
hisho72
👍 2
"that has never been seen on the network " it seems to me like TEST , and this match with Monitor action which does not need to inspection , Allow match pass with "inspection" while Trust without . so it is : B and E
Dinges
👍 5
either allow OR trust rule will trigger. Traffic will never hit both rules, so no point in configuring them both. ONLY with monitor rule first, will the traffic hit the second rule which is allow or trust: in this case it must be trust. so D and E are correct
hisho72
👍 2
"that has never been seen on the network " it seems to me like TEST , and this match with Monitor action , Allow match pass with "inspection" while Trust without .
bazinga31
👍 1
B and D are correct. - allow and trust - matching traffic is allowed
aaInman
👍 2
Allow -OR- Trust. When doing this in real life, there is a drop-down menu that will allow you to select Allow or Trust, can use both. Allow, allows traffic with inspection while Trust allows traffic to just pass without inspection. D and E seem appropriate in this scenerio
Jayde
👍 4
D & E Rule 1: Monitor evaluates traffic first. Monitor rules track and log network traffic. The system continues to match traffic against additional rules to determine whether to permit or deny it. (However, see an important exception and caveat at Access Control Rule Monitor Action.) Rule 2: Trust evaluates traffic next. Matching traffic is allowed to pass to its destination without further inspection, though it is still subject to identity requirements and rate limiting. Traffic that does not match continues to the next rule. Rule 3: Block evaluates traffic third. Matching traffic is blocked without further inspection. Traffic that does not match continues to the final rule. Rule 4: Allow is the final rule. For this rule, matching traffic is allowed; however, prohibited files, malware, intrusions, and exploits within that traffic are detected and blocked. Remaining non-prohibited, non-malicious traffic is allowed to its destination, though it is still subject to identity requirements and rate limiting. You can configure Allow rules that perform only file inspection, or only intrusion inspection, or neither.
klu16
👍 2
Yeah. Question states "WITHOUT INSPECTION". Monitor does not inspect traffic, just tracks and logs it. So D & E for me as well.
entitty
👍 2
B&D - Allow and Trust - You want the traffic to pass without inspection (monitor)
wfexco
👍 3
Should be D and E. - Monitor matches the criteria to see if the rule is set up correctly, without actually performing any action on the rule match.
rad9899
👍 32
D. trust E. monitor
loiphin
👍 12
In case you are still nervy about the above answers, then this diagram will calm your nerves :) https://www.cisco.com/c/en/us/td/docs/security/firepower/610/configuration/guide/fpmc-config-guide-v61/access_control_rules.html#ID-2190-00000005
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
In Cisco Firepower Threat Defense (FTD), the Access Control policy does not use a 'permit' action; instead, it uses 'allow'. However, the question asks for two actions to allow traffic without inspection for a new application. The specific actions designed for this purpose are 'monitor' and 'trust'. A 'monitor' rule logs traffic without blocking it, allowing the system to learn about the application. A 'trust' rule allows traffic to pass without further inspection (like IPS or malware scanning). Combining these ensures the traffic flows but is tracked and trusted.Why the Other Options Are Wrong
'Permit' (A) is not a valid action type in FTD Access Control rules; the equivalent is 'allow'. 'Allow' (B) is a valid action, but selecting 'allow' and 'trust' would be redundant or incorrect because 'trust' implies allowing. 'Reset' (C) drops the connection and sends resets, which blocks traffic rather than allowing it. 'Monitor' (E) alone logs but doesn't explicitly 'trust' the traffic against all future inspections in the same definitive way 'trust' does for known good patterns, though they are often used together. The question specifically targets the 'trust' mechanism for bypassing inspection.Community Comment Notes
Community consensus strongly supports D and E. As user rad9899 noted, 'trust' and 'monitor' are the correct pair. User west33637 explained that you create a monitor rule first, then a trust rule below it. User Dinges highlighted that 'allow' and 'trust' would conflict, whereas 'monitor' and 'trust' work sequentially. User Jayde provided an official Cisco link confirming that 'trust' evaluates traffic next, allowing it to pass without further inspection.Official Reference
Exam Strategy
Remember that FTD Access Control rules use 'allow', 'deny', 'monitor', and 'trust'. Never confuse 'permit' (ASA syntax) with 'allow' (FTD syntax). For 'no inspection' scenarios, 'trust' is the keyword.
Frequently Asked Questions
Why is 'permit' not an option in FirePower?
Firepower uses 'allow' instead of 'permit' which is found in traditional ASA CLI configurations.
What is the difference between 'allow' and 'trust'?
'Trust' allows traffic without any further security inspection (IPS, Malware), while 'allow' may still trigger some checks depending on other policies.