hardMultiple ChoiceObjective-mapped
350-701 Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. ! Cisco FMC intrusion policy snippet preprocessor global_sensitivity: sensitivity_level high preprocessor frag3: frag3_engine policy=first, bind_to=0.0.0.0 preprocessor stream5_global: track_tcp yes, track_udp yes preprocessor stream5_tcp: policy=windows, use_static_footprint_sizes yes preprocessor http_inspect: global iis_unicode_map unicode.map 1252 preprocessor http_inspect: default_inspect_http_profiles preprocessor smtp: ports 25 465 587 !
Refer to the exhibit. An engineer is analyzing an intrusion policy on Cisco Firepower Management Center (FMC). The network uses Windows servers and clients. A flood of HTTP traffic is being detected as a potential attack, but it is legitimate. Which preprocessor configuration change would most likely reduce false positives without losing detection of real attacks?
⚠ Common exam trap
Cisco often tests the misconception that disabling a preprocessor or changing unrelated protocol policies (like TCP or IP fragmentation) is the solution, when the correct answer is a targeted tuning parameter within the relevant preprocessor.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change global_sensitivity to medium
The http_inspect preprocessor's global_sensitivity setting controls how aggressively it normalizes HTTP traffic before analysis. Setting it to 'medium' reduces false positives from legitimate HTTP floods by relaxing the threshold for anomalous HTTP behavior, while still allowing the preprocessor to detect real attacks that exhibit more extreme deviations. This is the most targeted change because it directly addresses the flood of HTTP traffic without disabling the preprocessor entirely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable the http_inspect preprocessor
Why it's wrong here
Disabling HTTP inspection would prevent detection of HTTP-based attacks.
- ✓
Change global_sensitivity to medium
Why this is correct
Lowering sensitivity reduces false positives for benign traffic while still detecting true attacks.
- ✗
Change frag3 policy to bsd
Why it's wrong here
Frag3 policy affects IP fragmentation reassembly, not HTTP false positives.
- ✗
Change stream5_tcp policy to linux
Why it's wrong here
Linux policy is not optimal for Windows environment and may cause false negatives.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.