Exam 300-710 topic 1 question 18 discussion

To reduce low priority intrusion drop events and keep the high priority events visible, the "drop packet" action can be configured in the intrusion policy. This will silently drop the packets that trigger low priority intrusion events without generating any event or alert, thereby reducing the noise in the event dashboard.

To reduce the low priority intrusion drop events and focus on high priority events, the engineer should configure the action to: A. drop packet By setting the action to "drop packet," the system will drop the packets without generating events for low priority intrusions. This helps in reducing the clutter of low priority events in the event dashboard, allowing high priority events to stand out

it highlighted as B the correct answer. should be A

go with A

Correct answer is: A

This had me really confused for a bit, because I didn't see an option to just drop packet anywhere. I appears there is a difference between the versions of when this question was originally posted and now. The only Drop option in newer versions is Drop and generate events. I think the correct answer now would be to add a threshold to limit the number of events. Here's a link for version 6.2 that doesn't show a drop and generate events option: https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/working_with_intrusion_events.html Here's a link for 7.0 that doesn't show a drop option: https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/working_with_intrusion_events.html

A seems to be correct: IPS has three rule state: Generate Event, Drop and Generate Events and Disable currently, the rule is set to Drop and Generate Events and the event on the dashboard is inundated with low priority intrusion drop events, and they are asking to reduce it, so the best option is to set the low priority events to "Generate Event" so option A is correct, I believe.

I agree with kakakayayaya.

Intrusion policy only has generate events, disabled, and drop and generate events. So the answer is correct.

Drop packet is correct

A would make the most seance to me.

PS Event filtering with threshold should be the most appropriate solution for reducing events but there is no such answer......

generate events - it is exactly what was asked to avoid. To reduce amount of events we need to drop packets. Block with reset even better. So A and C make scene for me but would I vote for A.