300-710 SNCF Deployment Practice Question
An engineer deploys an NGIPS in passive mode using a SPAN (Switched Port Analyzer) port on a core switch. During traffic analysis, the engineer notices that the firewall is not seeing TCP reset packets generated by internal servers. What is the primary operational limitation of deploying an NGIPS in passive mode that explains this behavior?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Passive sensors operate out-of-band and cannot block traffic inline or guarantee packet delivery state synchronization.
Passive mode sensors receive a copy of traffic via SPAN or tap. Because they are out-of-band, they cannot block traffic inline or actively drop packets; they can only generate alerts or send TCP resets (if configured and supported), but cannot guarantee inline remediation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Passive sensors operate out-of-band and cannot block traffic inline or guarantee packet delivery state synchronization.
Why this is correct
Because passive sensors only monitor a copy of traffic, they cannot block live traffic inline.
- ✗
Passive mode forces the Snort engine to disable all custom intrusion rules.
Why it's wrong here
Custom intrusion rules can execute on passive traffic inspection just as well as inline traffic.
- ✗
Passive sensors cannot inspect encrypted TLS traffic due to missing cryptographic keys.
Why it's wrong here
Decryption can be configured independently of whether an interface is inline or passive, assuming visibility exists.
- ✗
SPAN ports automatically drop TCP reset flags for security reasons.
Why it's wrong here
Switches mirror traffic transparently without stripping TCP flags like RST.
About these practice questions
One of 478 original 300-710 SNCF practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Cisco exam blueprint
This 300-710 SNCF practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-710 SNCF exam.