Exam 300-710 topic 1 question 146 discussion

The question states: A network administrator is deploying a Cisco IPS appliance and needs it to operate initially without affecting traffic flows. IT NEEDS TO OPERATE INITIALY, meaning inline tap, because in the future, we willgo from not affecting traffic, to activating IPS. if you use passive deployment, meaning you copy data to IPS in the future you can't implement IPS rule blocking. For me It's B

https://www.cisco.com/en/US/docs/security/ips/5.0/configuration/guide/cli/cliinter.html#wp1033759

I believe C as well.

This is talking about a Cisco IPS appliance and not a FTD so leaning towards promiscuous mode

https://www.cisco.com/en/US/docs/security/ips/5.0/configuration/guide/cli/cliinter.html#wp1033699

"It must also collect data" meaning copy the data, only tap mode copy data without affect the network

The promiscuous mode of the Cisco IPS meets these requirements. It can be configured to operate initially without affecting traffic flows and collects data to provide a baseline of unwanted traffic before being reconfigured to drop it. In promiscuous mode, the IPS is configured to monitor traffic only and does not affect the flow of packets.

C is correct!

B is correct. Promiscuous mode doesn't exist.