An engineer has been tasked with configuring a Cisco FTD to analyze protocol fields and detect anomalies in the traffic from industrial systems.
What must be done to meet these requirements?
- Implement pre-filter policies for the CIP preprocessor
- Enable traffic analysis in the Cisco FTD
- Configure intrusion rules for the DNP3 preprocessor
- Modify the access control policy to trust the industrial traffic
Answer(s): C
Explanation:
"configure INTRUSION RULES for DNP3" -> Documentation states, that enabling INTRUSION RULES is mandatory for CIP to work + required preprocessors (in Network Access Policy - NAP) will be enabled automatically:
"If you want the CIP preprocessor rules listed in the following table to generate events, you MUST enable them. See Setting Intrusion Rule States for information on enabling rules."
"If the Modbus, DNP3, or CIP preprocessor is disabled, and you enable and deploy an intrusion rule that requires one of these preprocessors, the system automatically uses the required preprocessor, with its current settings, although the preprocessor remains disabled in the web interface for the corresponding network analysis policy."
[1] https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc- config-guide-v63/scada_preprocessors.html