Courseiva
hardMultiple ChoiceObjective-mapped

350-701 Practice Question: Refer to the exhibit

Exhibit

Refer to the exhibit.

! Cisco FMC intrusion policy snippet
preprocessor global_sensitivity: sensitivity_level high
preprocessor frag3: frag3_engine policy=first, bind_to=0.0.0.0
preprocessor stream5_global: track_tcp yes, track_udp yes
preprocessor stream5_tcp: policy=windows, use_static_footprint_sizes yes
preprocessor http_inspect: global iis_unicode_map unicode.map 1252
preprocessor http_inspect: default_inspect_http_profiles
preprocessor smtp: ports 25 465 587
!

Refer to the exhibit. An engineer is analyzing an intrusion policy on Cisco Firepower Management Center (FMC). The network uses Windows servers and clients. A flood of HTTP traffic is being detected as a potential attack, but it is legitimate. Which preprocessor configuration change would most likely reduce false positives without losing detection of real attacks?

⚠ Common exam trap

Cisco often tests the misconception that disabling a preprocessor or changing unrelated protocol policies (like TCP or IP fragmentation) is the solution, when the correct answer is a targeted tuning parameter within the relevant preprocessor.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Change global_sensitivity to medium

The http_inspect preprocessor's global_sensitivity setting controls how aggressively it normalizes HTTP traffic before analysis. Setting it to 'medium' reduces false positives from legitimate HTTP floods by relaxing the threshold for anomalous HTTP behavior, while still allowing the preprocessor to detect real attacks that exhibit more extreme deviations. This is the most targeted change because it directly addresses the flood of HTTP traffic without disabling the preprocessor entirely.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Disable the http_inspect preprocessor

    Why it's wrong here

    Disabling HTTP inspection would prevent detection of HTTP-based attacks.

  • Change global_sensitivity to medium

    Why this is correct

    Lowering sensitivity reduces false positives for benign traffic while still detecting true attacks.

  • Change frag3 policy to bsd

    Why it's wrong here

    Frag3 policy affects IP fragmentation reassembly, not HTTP false positives.

  • Change stream5_tcp policy to linux

    Why it's wrong here

    Linux policy is not optimal for Windows environment and may cause false negatives.

About these practice questions

Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.