Which of the following are Cisco FirePOWER Application Layer Preprocessors? (Choose 2).
A. SIP preprocessor
B. HTTP preprocessor
C. ICMP preprocessor
D. Modbus
Correct Answer: AB
Explanation/Reference:
– The SIP Preprocessor
The Session Initiation Protocol (SIP) provides call setup, modification, and teardown of one or more sessions for one or more users of client applications such as
Internet telephony, multimedia conferencing, instant messaging, online gaming, and file transfer. A methodfield in each SIP request identifies the purpose of the request, and a Request-URI specifies where to send the request. A status code in each SIP response indicates the outcome of the requested action.
After calls are set up using SIP, the Real-time Transport Protocol (RTP) is responsible for subsequent audio and video communication; this part of the session is sometimes referred to as the call channel, the data channel, or the audio/video data channel. RTP uses the Session Description Protocol (SDP) within the SIP message body for data-channel parameter negotiation, session announcement, and session invitation.
– The HTTP Inspect Preprocessor
The HTTP Inspect preprocessor is responsible for:
decoding and normalizing HTTP requests sent to and HTTP responses received from web servers on your network separating messages sent to web servers into URI, non-cookie header, cookie header, method, and message body components to improve performance of HTTPrelated intrusion rules separating messages received from web servers into status code, status message, non-set-cookie header, cookie header, and response body components to improve performance of HTTP-related intrusion rules detecting possible URI-encoding attacks making the normalized data available for additional rule processing
Link: https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Application_Layer_Preprocessors.html#ID-2244-0000080c
Explanation/Reference:
– The SIP Preprocessor
The Session Initiation Protocol (SIP) provides call setup, modification, and teardown of one or more sessions for one or more users of client applications such as
Internet telephony, multimedia conferencing, instant messaging, online gaming, and file transfer. A methodfield in each SIP request identifies the purpose of the request, and a Request-URI specifies where to send the request. A status code in each SIP response indicates the outcome of the requested action.
After calls are set up using SIP, the Real-time Transport Protocol (RTP) is responsible for subsequent audio and video communication; this part of the session is sometimes referred to as the call channel, the data channel, or the audio/video data channel. RTP uses the Session Description Protocol (SDP) within the SIP message body for data-channel parameter negotiation, session announcement, and session invitation.
– The HTTP Inspect Preprocessor
The HTTP Inspect preprocessor is responsible for:
decoding and normalizing HTTP requests sent to and HTTP responses received from web servers on your network separating messages sent to web servers into URI, non-cookie header, cookie header, method, and message body components to improve performance of HTTPrelated intrusion rules separating messages received from web servers into status code, status message, non-set-cookie header, cookie header, and response body components to improve performance of HTTP-related intrusion rules detecting possible URI-encoding attacks making the normalized data available for additional rule processing
Link: https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Application_Layer_Preprocessors.html#ID-2244-0000080c
