Cisco Updated 300-710 Exam Questions and Answers by preston

A custom application detector is a user-defined script that can detect web applications, clients, and application protocols based on patterns in network traffic. Custom application detectors are written in LUA, which is a lightweight and embeddable scripting language. LUA scripts can use predefined functions and variables provided by the Firepower System to access packet data and metadata, and to specify the detection criteria and the application information1.

To import a custom application detector file that was provided by a third party, you need to follow these steps1:

In the FMC web interface, navigate to Objects > Object Management > Application Detectors.

Click Import.

Browse to the location of the LUA script file and select it.

Click Upload.

Review the detector details and click Save.

The other options are incorrect because:

Perl script is not a supported format for custom application detectors. Perl is a general-purpose programming language that is not embedded in the Firepower System.

NBAR protocol is not a file type, but a feature of Cisco IOS routers that can classify and monitor network traffic based on application types. NBAR protocols are predefined and cannot be imported as custom application detectors.

Python program is not a supported format for custom application detectors. Python is a general-purpose programming language that is not embedded in the Firepower System.

Cisco Secure Cloud Analytics ingests network flows and traffic telemetry, such as NetFlow and cloud flow logs, and applies behavioral modeling to that information. It establishes a baseline of normal activity for entities such as hosts, users, and workloads. New activity is compared with the baseline to identify anomalies, suspicious communication patterns, lateral movement, command-and-control traffic, and potential data exfiltration. The platform does not merely forward or archive the collected information. Although its analytics may incorporate statistical methods and machine learning, Cisco specifically describes the solution as using entity and behavioral modeling. This allows it to detect threats based on how an entity acts over time, including previously unknown threats that would not necessarily match a conventional signature. Cisco Secure Cloud Analytics

================