I85PREP
⌘ K
Cisco 300-710 SNCF study materials
Cisco 300-710 SNCF study resources

Cisco 300-710 SNCF: Intrusion Prevention and Malware Defense

Cisco 300-710 SNCF · Work through your exam, one topic at a time.

All guide sections

Intrusion Prevention and Malware Defense

Domain 4 covers what happens after a rule says Allow: intrusion inspection, rule and variable tuning, and file/malware handling. Expect questions on drop-versus-alert behavior, rule state, base policies, and why a file was or was not blocked.

Intrusion policies

  • An intrusion policy is a rule set plus rule states, a variable set, and advanced settings (thresholds, suppression, SNORT_BP, performance). It is attached per Allow rule.
  • States are Generate Events (alert only) and Drop and Generate Events. Drops occur only when traffic is inspected inline; on a passive/IDS deployment drops cannot happen and you see events only.
  • Base policies: Balanced Security and Connectivity (default), Connectivity Over Security, Security Over Connectivity, Maximum Detection (most rules, highest load), and No Rules Active.
  • Variables: $HOME_NET and $EXTERNAL_NET must reflect your topology; swapped or over-broad values cause false positives or silent misses. Custom variable sets are per-policy.
  • Bulk rule changes come from metadata filters (policy, default state, category, CVSS, age, popularity) and Firepower Recommendations; review the resulting drops before deploying.

Network analysis and decryption

  • The network analysis policy handles decoding and preprocessors, defaulting to Balanced Security and Connectivity. Decryption is what exposes SMB and HTTPS file transfers and URL paths to inspection.

File and malware

  • A file policy is referenced by an Allow rule and holds rules per file category or type with actions: Detect Files, Malware Cloud Lookup, Block Malware, Block Files, Spero Analysis, per direction.
  • Malware Cloud Lookup sends a SHA-256 to the AMP cloud; if the cloud is unreachable, reputation cannot block the file. Spero performs dynamic analysis, and retrospective verdicts can reclassify files already seen.

Worked example

An inline FTD shows thousands of IPS events but zero blocks. Check the intrusion policy: rules are set to Generate Events, or the ACP rule points at the wrong intrusion policy. Set Drop and Generate Events, confirm the deployment is inline, deploy, and retest.

Traps

  • Expecting drops from a passive tap or inline-set configured as passive.
  • Trust rules skipping file and IPS inspection entirely.
  • Forgetting decryption so HTTPS downloads are never inspected.
  • Confusing Block Files (type-based) with Block Malware (verdict-based).