hardMultiple ChoiceObjective-mapped
200-201 Practice Question: A company uses Cisco Firepower NGFW with…
A company uses Cisco Firepower NGFW with intrusion prevention. An analyst notices that many legitimate HTTPS connections are being blocked by an IPS rule. What is the best approach to reduce false positives?
⚠ Common exam trap
Cisco often tests the misconception that changing the rule action to 'Alert' is a safe compromise, but this actually disables blocking for all traffic matching the rule, not just the false positives.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom rule exception for the specific destination IPs.
Creating a custom rule exception for the specific destination IPs is the best approach because it allows the IPS to continue blocking malicious traffic while exempting legitimate HTTPS connections that are incorrectly flagged. This maintains security posture by not weakening the rule globally, and it directly addresses the false positive without affecting detection of other threats.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a custom rule exception for the specific destination IPs.
Why this is correct
Exceptions preserve protection while allowing legitimate traffic.
- ✗
Increase the severity threshold of the rule.
Why it's wrong here
Severity thresholds do not affect rule action.
- ✗
Disable the IPS rule entirely.
Why it's wrong here
Disabling removes protection against real threats.
- ✗
Change the rule action from 'Drop' to 'Alert'.
Why it's wrong here
Alerting only logs, does not prevent false positive blocks.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.