Which of the following MPF elements can be used to configure Application layer protocol inspection? (Select the best answer.)

A. a class map

B. a policy map

C. a service policy
D. a global policy
E. an extended access list
F. a standard access list

Explanation:
A policy map can be used to configure Application layer protocol inspection. Modular Policy Framework (MPF) is a Cisco Adaptive Security Appliance (ASA) feature that provides a flexible method of enabling security policies on an interface. This framework consists of three basic components: class maps, policy maps, and service policies. A class map identifies a specific flow of traffic, a policy map determines the action that will be performed on the traffic, and a service policy ties this action to a specific interface. Application inspection is one of the actions that can be applied to traffic with a policy map. Services that embed IP addresses in the packet or utilize dynamically assigned ports for secondary channels require deep packet inspection, which is provided by Application layer protocol inspection. Some traffic, such as File Transfer Protocol (FTP) traffic, might be dropped if inspection for that protocol is not enabled. Application inspection can be configured within the global service policy and within an interface service policy. Service policies can be applied to an individual interface or globally to all interfaces? if traffic matches both an interface policy and a global policy, only the interface policy will be applied to that particular traffic flow.
A class map cannot be used to configure Application layer protocol inspection. Class maps identify traffic by matching a variable characteristic that you specify, such as traffic going to a unique IP address or traffic using a specific port. Generally, each class map can contain only a single match statement, and a packet can match only a single class map within the policy map of a particular feature type. For example, if a packet matched a class map for FTP inspection and a class map for traffic policing, the ASA would apply both policy map actions to the packet. However, if a packet matched a class map for FTP inspection and a second, different class map that included FTP inspection, the ASA would apply only the actions of the first matching policy map. Class maps are assigned to a policy map, which defines the action or actions to be performed on the traffic.
A service policy cannot be used to configure Application layer protocol inspection. Service policies tie the policy map to the interface and can be applied to an individual interface or globally to all interfaces? if traffic matches both an interface policy and a global policy, only the interface policy will be applied to that particular traffic flow. Service policies can be configured by using Cisco Adaptive Security Device Manager (ASDM) or by commandline interface (CLI) configuration. Neither an extended access list nor a standard access list can be used to configure Application layer protocol inspection. Access control lists (ACLs) can be used to filter traffic based on a set of configured rules. You can create either standard or extended ACLs. Whereas standard ACLs can be used to filter based only on source IP addresses, extended ACLs can be used to filter based on source and destination IP addresses, protocols, and ports. A class map can match traffic to an extended ACL that is specified as a parameter to the accesslist keyword in a match statement.
Reference:
Cisco: Using Modular Policy Framework: Information About Inspection Policy Maps
Cisco: Getting Started With Application Layer Protocol Inspection: Configuring Application Layer Protocol Inspection