Topic: 300-710 topic 1 question 299

When packet capture is used on a Cisco Secure Firewall Threat Defense device and the packet flow is waiting on the malware query, which Snort verdict appears?

A.
block
B.
retry
C.
replace
D.
blockflow

Re: 300-710 topic 1 question 299

Looks like retry based on the following link:

https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/troubleshooting_the_system.html

  • gwb
  • New member
  • Offline

Re: 300-710 topic 1 question 299

D.

BlockFlow Verdict:
The BlockFlow verdict is specific to Snort.
When a packet receives the BlockFlow verdict, it is dropped immediately, and subsequent packets in the same session are also dropped before reaching Snort.
Essentially, it prevents any further processing of that flow.
Use Cases:
Malware Detection: For example, if Snort identifies a packet as malicious (e.g., malware), it may assign the BlockFlow verdict to prevent any additional communication from that source.