What can the SMTP preprocessor in FirePOWER normalize?
A . It can extract and decode email attachments in client to server traffic.
B . It can look up the email sender.
C . It compares known threats to the email sender.
D . It can forward the SMTP traffic to an email filter server.
E . It uses the Traffic Anomaly Detector.
Answer: A
Explanation:
Decoding SMTP Traffic
The SMTP preprocessor instructs the rules engine to normalize SMTP commands. The preprocessor can also extract and decode email attachments in client-to-server traffic and, depending on the software version, extract email file names, addresses, and header data to provide context when displaying intrusion events triggered by SMTP traffic.
Source: http://www.cisco.com/c/en/us/td/docs/security/firesight/541/firepower-module-userguide/asa-firepower- module-user-guide-v541/NAP-App-Layer.html#85623
Leave a Reply