SNCF practice questions
Cisco · SNCF · 300 questions
Original practice questions for the Securing Networks with Cisco Firewalls exam, covering every domain of the official exam outline.
This course contains the use of artificial intelligence.
About the SNCF exam
- Questions
- not published
- Passing score
- not published
- Format
- 90-minute exam associated with the CCNP Security certification
Schedule this exam The certification this earns
Exam details published by the vendor, checked 3 November 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Deployment (30%) · 90 questions
- The bank is inserting an FTD appliance between its server VLAN and the internet edge router so traffic can be inspected and controlled. The server subnet keeps its existing addressing, outbound sessions must be translated to the outside interface address, and the appliance must learn remote routes from the router through OSPF rather than from static entries. Which routed-mode configuration should the engineer implement for addressing, NAT, and routing?
- A service provider is replacing a customer's edge router with a Secure Firewall Threat Defense appliance running in routed mode, and its access policy already permits the required flows. Inside hosts with private addresses must reach the internet, the Network Operations Center must reach the appliance's inside interface, and an external partner must reach a private web server. Which routed-mode configuration satisfies all three requirements?
- A branch office replaces its router with an FTD appliance in routed mode. The inside interface faces the core switch, the outside interface faces the ISP router, and the core switch already uses the appliance as its default gateway. The ISP forwards traffic for one public address only. Which configuration completes the routed-mode path for outbound traffic?
- A manufacturer is deploying a Threat Defense appliance in routed mode between the campus core switch and the ISP edge. Internal hosts in the 10.20.0.0/16 network must reach internet destinations, the existing switch and host addressing stay exactly in place, and the provider edge performs no translation for customer subnets. Which configuration set completes this routed-mode deployment?
- A manufacturer is inserting an FTD appliance in routed mode between its core switch and the ISP router. Inside hosts use 10.20.0.0/16, the ISP gives a public /30 for the outside link and routes a public /29 for published services, while four web servers must stay publicly reachable on private addresses. Which routed-mode configuration meets these requirements?
- A bank is placing a Threat Defense appliance between the core switch and the ISP link in routed mode, with private subnets inside and public addresses outside. Engineers must settle addressing, NAT and routing before go-live. Which statement describes how routed mode forwards traffic between its interfaces?
- A retailer wants to add threat inspection between a pair of Layer 2 switches at a store while host addresses and the default gateway stay exactly as they are. The engineer plans to deploy Secure Firewall Threat Defense in transparent mode. Which configuration detail describes how the appliance joins that Layer 2 segment in transparent mode?
- A data center team must insert an FTD appliance between a legacy application server and its access switch without changing the server's IP address, its default gateway, or the subnet's existing routes. The appliance has two interfaces and must still apply access control to the server's traffic. Which FTD deployment configuration meets these Layer 2 constraints?
- A hospital must insert an FTD between two switches carrying 192.168.10.0/24; every host keeps its current address and default gateway, and broadcasts must still cross the link. Management access from the data center has to work as well. Which transparent-mode design should the engineers deploy?
- A regional hospital is inserting an FTD appliance in transparent mode between its core switch and its imaging servers, which must keep their current addresses. A second interface pair connects a partner clinic link that must stay in its own broadcast domain. Which bridge group design meets both requirements?
- A retail chain is inserting an FTD appliance between its access switch and distribution router so the point-of-sale servers keep their current addresses. The appliance must filter at Layer 2 while routing stays elsewhere, keep both segments in one broadcast domain, and hold its management address on one virtual interface in the production subnet. Which FTD deployment mode and interface design satisfies every requirement?
- After moving two campus lab switches behind an FTD appliance in transparent mode, an engineer confirms that the unicast access rules show steady hits. The ARP tables still fill on both sides, yet no rule matches ARP traffic. Which statement best explains how the bridge group handles ARP frames?
- A university is inserting an FTD appliance between its campus core switch and a new research VLAN of 300 hosts. The hosts must keep their existing IP addresses, the appliance must be the segment's default gateway, and the appliance must translate outbound traffic so it leaves through one public address. Which operating mode meets all three requirements for the research VLAN?
- A greenfield branch is being built with two new segments, one for staff workstations and one for a small server rack, and addresses are being assigned from scratch. The architect requires the appliance to act as the gateway for both segments, each segment to arrive on its own physical port, and device management to use a dedicated port. Which deployment mode and interface layout satisfies this design?
- A hospital must protect traffic between its server VLANs, which are routed by the existing router through a Layer 2 switch. The network team requires every server IP address and default gateway to stay exactly as they are, and the existing router configuration is frozen. The FTD has been placed physically between the switch and that router, so all inter-VLAN traffic traverses it, and it must actively block traffic by policy. Which deployment mode meets these insertion requirements?
- A regional hospital must place an FTD in front of a new server farm. The user VLANs and the server subnet are different networks, so the firewall has to route between them; threats must be actively blocked rather than just logged; and every existing host IP address must stay unchanged. Which deployment mode satisfies these insertion requirements?
- A regional insurer must inspect traffic flowing from a core switch into a server farm using one existing Secure Firewall Threat Defense appliance, and the change ticket forbids re-addressing hosts, altering the servers' default gateway, or changing the subnet layout. Which deployment mode best satisfies the ticket's insertion constraints?
- A hospital must insert an FTD between an access switch and the upstream router on a flat subnet during a ninety-minute window. Host addresses, masks and their default gateway must remain untouched, and the firewall must enforce per-host access rules on that same subnet while the management center manages it out of band. Which Secure Firewall deployment mode meets this insertion requirement?
- A teaching hospital must detect attacks on a core switch segment that carries patient monitoring traffic. The switch supports port mirroring, spare appliance interfaces are available, and the team requires packets to keep flowing on time even if the appliance fails or a signature matches. Which NGIPS deployment design should the team implement for this segment?
- A regional hospital must watch for exploit attempts on its clinical VLAN while patient-monitoring traffic stays completely unaffected, and the core switch's mirror session drops frames whenever nightly backups saturate the uplink. The team needs lossless copies of both directions of every conversation with the sensor out of the traffic path. Which passive deployment design satisfies all three requirements?
- A regional hospital has one spare FTD appliance and requires zero disruption to patient-monitor traffic, though its core router team can push ACL updates within minutes. Which SPAN-based passive deployment should the hospital build to keep the FTD out of the production data path?
- A utility operator runs an FTD sensor in passive mode on a switch SPAN port. The sensor raises alerts for known-bad traffic, including a test download that it flagged correctly, yet the sessions still complete and the file is delivered. Which factor most directly explains why the flagged traffic continued to flow?
- A logistics company must inspect both directions of a full-duplex 10-Gbps uplink between its warehouse core switch and the WAN router with a Secure Firewall Threat Defense appliance running in passive mode. Traffic bursts can fill both directions at once, and the appliance reboots during a maintenance window while warehouse operations continue. Which monitoring design fits this passive deployment?
- A university team is piloting Secure Firewall Threat Defense to inspect traffic flowing between its student VLANs and its server VLANs. The core switch stack must keep production traffic forwarding at all times, and the pilot's only approved resource is one spare 10 Gb capture port on that stack. Which passive monitoring deployment design meets every constraint?
- A data center team must place a Secure Firewall Threat Defense appliance inline between the web and application tiers, where attacks must be dropped and a reboot must never interrupt production, and inline before the payment segment, where traffic must stop whenever inspection is unavailable. Which inline interface configuration satisfies all three requirements?
- A payment processor restarts the Snort process on its single FTD appliance every Sunday night and has no budget for a second device. The card-network link must stay up, and the appliance must block exploit traffic whenever inspection is available. Which inline configuration should the team choose for the interface pair?
- A payment processor must block known exploits in real time, but compliance requires that card traffic keep flowing if the inspection engine fails, and the design must leave addressing and routing on the production segment exactly as they are. Which IPS deployment design satisfies all three requirements at once?
- A payment processor is inserting one Threat Defense appliance between its cardholder application tier and the database tier. The security policy must drop known exploit traffic inline, and the business requires traffic to keep flowing if the appliance's Snort inspection process stops during maintenance. The budget funds a single chassis. Which forwarding behavior should the engineer set for the inline set?
- A retail chain must inspect traffic entering its payment environment and block exploit attempts before they reach the application servers. Its availability policy requires customer traffic to keep flowing when the Snort process is unavailable, even though inspection is briefly unavailable. Which NGIPS interface and failure policy combination meets both requirements?
- A retail chain places an FTD sensor at the data center edge so exploit traffic is blocked while it crosses the production path. Some policy deployments restart the inspection engine, and the network team requires traffic to continue forwarding during those restarts. Which NGIPS interface mode blocks exploits while allowing traffic to pass uninspected during an engine restart?
- A hospital must inspect traffic between its inpatient wireless VLAN and the EHR servers. Security requires blocking exploit attempts within the same TCP session, and the network team will tolerate a brief failover but not a sustained traffic outage if the device fails. Which NGIPS deployment mode should be selected?
- At a regional hospital, maintenance windows are unavailable for two quarters and facilities will approve only a switch mirror feed. The security team still needs months of exploit and file events from both server-to-server and internet traffic before enforcement. Which deployment mode should the engineer implement for this visibility phase?
- A state university must add its first FTD sensor to the distribution switch uplink that carries registrar traffic. A third party owns the fiber plant, so every production cable must stay exactly as it is, yet the SOC still needs full payload inspection and alerts from day one. Which NGIPS deployment mode satisfies this constraint?
- A municipal water plant must add IDS coverage to its control network before an upcoming audit. Plant rules forbid any appliance from sitting in the path of control traffic, and they ban new cabling or taps beyond a mirror session the core switch already supports. Engineers need signature-based alerts on exploit attempts this quarter, with blocking deferred to phase two. Which deployment mode meets those constraints?
- A mid-size insurer is placing one FTD appliance in front of its claims portal. The network team requires that exploit traffic be dropped before it reaches the servers, that the link keep forwarding if the inspection engine fails, and that only this single appliance be available. Which NGIPS deployment mode and failure behaviour should be used?
- A regional hospital must run NGIPS inline on its storage network links, where a sustained interruption during an appliance power failure would halt imaging transfers. While the sensor is operational, exploit attempts must be dropped as soon as they match an inspection rule. The team has budgeted fail-open bypass hardware for every link. Which Secure Firewall Threat Defense deployment design satisfies both requirements?
- You are cabling a single Secure Firewall Threat Defense appliance whose two 1 GbE data ports uplink to one Nexus switch that has LACP enabled on those ports. Both links must carry inside traffic today, cutting either cable must not interrupt the inside VLANs, and the existing access-control policy must stay untouched. Which port-channel design should you configure on the FTD interfaces?
- Two 10-GbE links run from the FTD appliance to a Catalyst switch whose ports are already configured for LACP active mode. The design calls for one logical interface, traffic balanced over both links, and a member removed from service if a cable breaks and traffic flows only one way. Which port-channel configuration on the firewall meets all three requirements?
- A branch office has two 1-Gigabit copper links from a collapsed-core switch to an FTD appliance in routed mode. The network standard requires the pair to present as one logical interface, to detect a failed or mispatched member through negotiation rather than by traffic loss, and to be built with LACP on the switch side. Which port-channel design on the FTD meets the branch standard?
- A data center team is adding a four-link 10 GbE uplink to a Secure Firewall Threat Defense appliance for a virtualization cluster. The top-of-rack switch is already set to LACP passive and cannot be changed, and member link failures must be detected quickly. Which port-channel setup on the firewall satisfies all three conditions?
- An FTD appliance connects to a campus access switch with two 10 GbE links bundled into one port channel running LACP. Before the design review, the team must state how traffic is actually spread across the member links. Which description of the EtherChannel forwarding behavior is accurate?
- A data center FTD is getting a new outside uplink: four 10 Gbps links to a top-of-rack switch that the network team already configured for LACP. The uplink must deliver up to 40 Gbps of aggregate capacity across traffic flows on a routed Layer 3 interface, with the public address and outside zone on one logical interface and no VLAN tagging. Which port channel design meets the deployment requirements?
- Two FTD appliances are being paired as an active/standby high availability set in the data center. Heartbeats and configuration synchronization must travel on a dedicated failover link, live connection and NAT state must survive a failover, and a flap on any single data interface must leave the active unit in charge. Which design and trigger behavior satisfies all three requirements?
- An FTD active/standby pair is cabled with a dedicated failover link, and the standby unit takes over promptly whenever the active unit loses power. After every switchover, established TCP sessions reset and users must reconnect. Which link carries the session data that keeps those connections alive?
- During a failover test, engineers pull the fiber that carries the state link of an active/standby FTD pair and wait for a transition. The dedicated failover link stays healthy, heartbeats continue, and the active unit never changes. Which statement about the failover link, the state link, and failover triggers explains the outcome?
- A logistics firm is pairing two identical Secure Firewall Threat Defense appliances in active and standby roles at its data center edge. Failover and state traffic must stay off the production links, established sessions must survive a switch, and the standby must take over when the active appliance dies or a monitored WAN port fails. Which active and standby failover design meets those requirements?
- A retail bank runs an FTD active/standby pair with failover heartbeats and connection-state replication sharing one 1-Gbps link between the units. During large file transfers the standby sees delayed heartbeats and declares the primary unreachable even though it is still passing traffic. Which change to the failover link design keeps the pair's health checks accurate?
- A hospital is pairing two Threat Defense appliances in active/standby mode for its network core. The design must keep established TCP and UDP sessions alive through a failover, force a unit switch when the outside uplink fails, and keep heartbeat traffic separate from the replicated session state. Which failover link and trigger design meets all three requirements?
- A branch runs Threat Defense in routed mode with two equal-cost static routes through different ISP gateways. Last month the second gateway stopped responding while the local interface stayed up, and the firewall kept sending half the flows into a black hole. Which change keeps traffic on the working paths while both ISP circuits stay in service?
- A branch office's routed-mode Secure Firewall Threat Defense has two WAN interfaces, each connected to a different ISP, and the engineer wants one default route per interface with the same metric so traffic spreads across both paths. The inside user network sits on a VLAN interface that must stay untouched. Which ECMP configuration makes the two default routes load-balance?
- A retail chain connects its next-generation firewall to two ISPs of equal bandwidth and wants outbound sessions to share both links during normal operation. The design must use equal-cost next hops only, keep every TCP session on a single path, and avoid policy-based routing. Which ECMP routing design on Threat Defense satisfies these constraints?
- A branch runs an FTD in routed mode with two ISP uplinks on separate outside interfaces, and the team wants outbound flows spread across both paths using static routes configured in the FMC. The inside interface must keep relaying DHCP for the user VLAN. Which ECMP setup meets these requirements?
- A branch runs FTD in routed mode between the LAN and two ISP uplinks that reach the same remote prefixes. The network team wants outbound flows load-balanced across both links during normal operation, and every session must still be matched and inspected by the state that saw the first packet. Which ECMP approach meets both requirements?
- A broadcaster's FTD has two equal-capacity uplinks, one to each of two routers that both advertise the default route. Today the team gives the second route a higher metric so it stays a warm backup, and they want outbound flows to use both links while each conversation stays on one path. Which routing design gives them equal-cost multipath forwarding?
- A branch office runs an FTD whose default route points at ISP-A, with a floating backup route through ISP-B. The ISP-A first hop keeps answering while traffic beyond it black-holes, so the box keeps sending users into a dead path. The team wants failover driven by reachability of a stable target on the far side rather than by interface state. Which route-tracking design should be configured on the primary default route?
- A branch FTD has two ISP uplinks, and the primary interface stays up when the provider's peering path fails, so the default route stays in the routing table. The architect still wants both ISP routes kept as static routes in the FMC and needs traffic to shift to the backup ISP when a probe beyond the local gateway stops replying. Which control should be bound to the primary static route to make that failover happen?
- A branch office gets a primary broadband circuit plus a backup LTE link, but the ISP offers no BGP session and hands over a single routed interface. Engineers need Secure Firewall Threat Defense to drop the primary default route on its own as soon as the ISP next hop stops answering, without an operator. Which high availability design should they use for static route tracking at this site?
- A retail branch runs a single Secure Firewall Threat Defense appliance with two static default routes, one per ISP handoff, because both providers supply static routes only. When one ISP fails, its router stays powered and the handoff interface stays up, so traffic blackholes until an operator intervenes. Which route-tracking design should move branch traffic onto the surviving ISP?
- A clinic runs routed-mode Secure Firewall Threat Defense (FTD) with two ISP uplinks. The primary uplink keeps its static default route even when the ISP's first hop stops answering, so traffic blackholes until an operator shuts the interface. The backup static route must stay ready but unused while the primary path is healthy. Which static route tracking design with an SLA monitor should the engineer configure for link failover?
- A branch office runs an FTD appliance with two static default routes, the primary pointing to ISP one and a backup to ISP two at a higher metric. The ISP hands addressing down statically with no routing protocol peering. Last night the ISP one gateway stopped answering while the FTD interface stayed up, so traffic blackholed for ten minutes. Which routing change makes the primary route withdraw when its gateway goes silent?
- A bank is clustering eight identical Secure Firewall Threat Defense appliances to raise data center throughput. The design must deliver four things: higher aggregate throughput, one single Management Center view, session state that survives losing the leadership unit, and cluster chatter kept off the production interfaces. Which role and cluster control link arrangement meets all four requirements?
- A retailer plans to group four appliances at the distribution center into a cluster so aggregate throughput grows beyond a single box while the site stays online if one appliance dies. The network team needs the roles, configuration handling, and the intra-cluster wiring documented before cabling begins. Which statement about cluster roles, configuration, and the cluster control link is correct for this design?
- A regional streaming company is consolidating two data center edge sites into one security platform. Traffic must be distributed across appliances that all forward traffic simultaneously, aggregate throughput must grow as units are added, one appliance must own cluster health and configuration, and state must stay synchronized across units. Which high availability and scaling design meets the throughput, role, and state requirements?
- A retail chain places four Secure Firewall Threat Defense nodes in a cluster behind a load balancer to absorb peak traffic. Which member coordinates cluster-wide control-plane functions while all members forward production traffic?
- A security engineer is designing a Secure Firewall Threat Defense cluster for a data center that must scale past a pair of appliances. One node has to coordinate cluster health monitoring and the policy updates arriving from Secure Firewall Management Center, while every node still forwards production traffic and a dedicated cluster control link joins the nodes together. Which part of this cluster design performs those coordination duties while traffic keeps flowing?
- A colleague is mapping out Threat Defense clustering for a refresh project and asks how the roles divide the work. Which statement correctly describes the control unit, the data units, and the cluster control link in a healthy cluster?
- A regional insurance office runs a single Threat Defense appliance and needs the branch to survive a hardware failure automatically with only one extra identical appliance available. The design must stay stateful and simple to manage from the Management Center. Which high availability design fits the office best?
- A healthcare provider's internet edge runs a single FTD appliance that saturates during open enrollment. The design must push peak throughput past one appliance, keep one policy set under a single management center, and keep the edge serving if one appliance fails. Which high availability design meets all three requirements?
- A content provider's central data center sees sustained traffic peaks above one appliance's throughput, and a single node failure must leave supported established sessions running. The team also requires that inter-node state traffic stays off the production links. Which high availability design meets the throughput, session continuity and dedicated state-link requirements?
- A retail bank has budget for exactly two firewall appliances, one installed in each of its two buildings and joined by a dedicated Layer 2 link sized for failover and state traffic but far below the throughput a cluster control link would need. Peak traffic fits comfortably inside one appliance, the pair must fail over automatically with established sessions preserved, and only these two units are approved hardware. Which high availability option best fits this two-unit site?
- A data center expects traffic growth beyond what one appliance can pass, and supported established sessions must survive a hardware failure while the whole platform is managed as one system. Which device availability design meets all of those requirements?
- A regional office has two Secure Firewall Threat Defense appliances in one rack. Peak traffic stays well within a single appliance, the budget allows only those two units, and existing sessions must survive a hardware failure while one unit handles production traffic at a time. Which high availability design meets the capacity and session requirements?
- A retail company deploys an FTDv instance in an AWS VPC to route and NAT traffic between a public subnet and a private subnet. Routes, an Elastic IP on the outside interface, and security-group rules are in place. The appliance's own HTTPS page opens, while every session that tries to transit through it times out. Which AWS instance setting should the team change so the appliance can forward traffic for other hosts?
- A regional bank is deploying its first Secure Firewall Threat Defense Virtual on the on-premises VMware cluster and a second instance in Azure for a branch workload. Both must be configured and monitored from one console with identical policy objects. Which management arrangement lets the team run one policy across both virtual appliances?
- A retailer is standing up its first two virtual Secure Firewall Threat Defense appliances: one on an on-premises ESXi cluster and one in an Azure VNet. Both must be administered from the existing on-premises Secure Firewall Management Center with a single access control policy, and the Azure network security group must allow management traffic from the FMC. Which virtual appliance management design satisfies all three requirements?
- A hospital group's existing Management Center already governs its physical firewalls, and the team must add a Secure Firewall Threat Defense virtual appliance in AWS for a new outpatient portal. The cloud management interface must stay off the public internet, and policy must remain in the existing FMC. Which virtual deployment and registration design meets both requirements?
- A retailer is moving checkout workloads into AWS while keeping a private data center on VMware. Security mandates a single Secure Firewall Management Center (FMC) console, inspection inside each environment, and management traffic carried on private connectivity. Which deployment model satisfies all three requirements?
- A retailer runs four virtual Secure Firewall Threat Defense appliances on its on-premises ESXi cluster and three FTD instances launched from the AWS marketplace. Compliance requires the management console itself to run on premises inside the corporate network, and the team wants one console with shared objects. Which management deployment satisfies both requirements?
- A bank is retiring the appliance its team still calls the Firepower Management Center, the product's earlier name, and has deployed a virtual Secure Firewall Management Center in its own data center. The new appliance has its address, DNS, and a Smart Licensing token, and it can reach all twelve device manager interfaces. The old manager still owns every device and its policies. What sequence should the team follow to register the devices with the new virtual Management Center?
- A retailer is standing up its first SOC. Compliance requires the management plane to stay in its own data center as a virtual machine on the existing cluster, and the design must use one management console for every device. The fleet is 24 branch FTD appliances plus six FTDv instances in AWS that already reach the data center over an IPsec tunnel. How should the AWS firewalls be registered with the on-premises virtual Management Center?
- A virtual Secure Firewall Management Center (FMC) is deployed on a vSphere host, and a Threat Defense Virtual appliance in the same cluster must be brought under its control. Its image offers only a command line, the appliance must originate its own management connection, and first trust must use a registration key configured in FMC. Which statement correctly describes that first registration?
- A regional hospital is standing up its first virtual Management Center to manage four FTD virtual appliances in its private cloud and two physical FTD appliances in clinics that use carrier-assigned addresses for the contract year. The vFMC cannot open sessions to the clinics, but the clinic appliances can reach the vFMC. The clinics cannot be readdressed or given inbound reachability during the contract year. Which registration approach lets all six devices join this single Management Center?
- A security team has just deployed a virtual Secure Firewall Management Center on a vSphere cluster and is onboarding appliances that were previously managed by a retired Management Center. One FTD appliance still reports the decommissioned manager, so the Add Device request fails. Which registration step must happen on the device CLI before the appliance can join the new Management Center?
- A security team deploys the Secure Firewall Management Center as a virtual appliance on an ESXi host at headquarters and must onboard a branch FTD that has never had a manager configured. Console access to the FTD is available, both management interfaces can communicate over the required management ports, and the team holds FMC admin rights. Which registration procedure binds the branch FTD to the virtual Management Center?
- A retailer runs FTD Virtual instances in AWS and Azure, and its infrastructure is entirely in the public cloud. The team wants one console for policy and objects, prefers that Cisco hosts and patches the manager, and plans to onboard a supported release. Which cloud management option fits these requirements?
- A startup with no data center or office servers runs FTD virtual appliances in AWS and Azure and wants one place to build policy for both clouds. Every appliance can open a management session to an address in AWS, and the budget covers one management instance. Which cloud management option gives them that single policy source?
- A retailer runs FTD virtual instances in a cloud VPC alongside its on-premises firewalls. The instances have only outbound connectivity, the existing site-to-site VPN already carries traffic to the data center where the Management Center lives, and the team wants one place to build and deploy policies for both environments. Where should the cloud instances be registered to keep one console and stay on the existing VPN?
- A SaaS company runs FTD virtual instances in two AWS regions and wants one place to build and push policy. Management interfaces must sit in a separate VPC that only the security team's jump hosts can reach, and management traffic must stay clear of the congested site-to-cloud link. Which management placement for these virtual appliances meets all three requirements?
- A retail company runs ten supported Secure Firewall Threat Defense virtual appliances across AWS VPCs and its on-premises hypervisors. Operations has no capacity to deploy or patch another management virtual machine, and administrators need a single console that applies consistent policy everywhere. Which management option best fits these ten virtual appliances?
- A retailer has eight Threat Defense virtual appliances spread across two accounts on the same cloud provider and needs one place to build and push policy to all of them. Corporate requires that every management session travel only inside the cloud network and never ride the link to headquarters. Which virtual appliance management design keeps policy in one place while meeting that requirement?
Configuration (30%) · 90 questions
- A security architect is writing the configuration standard for a new deployment of Secure Firewall Management Center with three FTD devices, and events must correlate cleanly across the whole system. Which configuration aligns the Management Center clock with the clocks of the registered devices?
- A payment processor runs a Secure Firewall Management Center (FMC) with sensors in three regions. The auditor requires that FMC and sensor event timestamps match the enterprise SIEM, that configuration is captured before every change window, and that only named administrators reach the GUI. Which FMC system setting satisfies the shared timestamp requirement?
- A customer wants to spot command-and-control traffic inside TLS sessions but has ruled out decryption, so they ask what the Encrypted Visibility Engine actually looks at. Which detail from the TLS handshake does EVE use to identify the application?
- A branch office runs voice and video over a single 100 Mbps uplink that saturates during nightly backups, making calls choppy. The budget allows only the current link, and the team wants the fix enforced on the Threat Defense appliance rather than the router. Which QoS rule on Threat Defense can limit bulk transfers while leaving real-time media uncapped?
- A branch office carries SIP voice, a video-conferencing subnet and large backups to a cloud target across one 50 Mbps ISP link. At 4 p.m. the link saturates and calls break up while the backup keeps flowing, and change control allows only the QoS policy editor. Which Threat Defense QoS design protects the real-time traffic?
- A hospital runs its radiology reporting app as plain HTTP on TCP 8443. FTD is inspecting the server segment, but the app's traffic appears only as a raw TCP stream, so the HTTP decoder never normalizes requests and intrusion inspection misses header anomalies. The team wants this traffic analyzed as HTTP while the app keeps port 8443. Which network analysis policy change should the engineer make?
- A utility's security team reads a Talos advisory about a new remote code execution exploit, and their FTD release is already current and stable. Only content-level updates are approved in this week's change window, and the team wants detection coverage today. Which Management Center content update should be applied first?
- An engineer is adding a rule for partner subnet 10.20.30.0/24 reaching internal servers on TCP 8443, plus a URL condition for a legacy portal. That subnet also sits in a network group holding several other ranges, shared with another policy that must stay unchanged. Which set of object types keeps this rule correct and the other policy untouched?
- A manufacturing firm's policy requires TLS inspection of employee web traffic so IPS and file policies can see inside sessions, while sites that pin certificates, such as corporate banking and government portals, must pass through untouched. The CISO also insists that any session the firewall cannot decrypt is blocked rather than allowed onward. Which SSL decryption policy design should the engineer apply?
- Our sales team of 40 people works from home laptops and must reach only the application servers in 10.20.30.0/24, and the security team requires per-user certificate authentication from the company PKI. Web browsing must keep leaving directly from each laptop, and the FMC already manages an FTD appliance at the data center edge. Which remote access VPN configuration should you deploy on the FTD?
- A hospital network team runs four Secure Firewall Threat Defense devices from one Secure Firewall Management Center. Intrusion prevention signatures must refresh every night, no sensor may reboot because the ward network runs around the clock, and no software upgrade is approved this quarter. Which update approach should they schedule for the nightly intrusion rule refresh?
- A manufacturing customer connects its data center FTD, which has a static public address, to a supplier's firewall that also has a static public address. The supplier contract requires IKEv2 with a pre-shared key, and reachability through the tunnel must be limited strictly to the data center's 10.20.0.0/24 application subnet. Which site-to-site VPN configuration meets every condition?
- A branch maintenance window is running, so a rule blocking the whole branch subnet sits near the top of the access control policy, and the policy default action must stay block all packets. A rule allowing the analytics server was added at the end of the list, but connections to that server are still dropped. Two allow rules below the block open branch traffic to monitoring hosts, and those flows must stay blocked until the window ends. Which access control rule change lets only the analytics server through?
- A contractor needs access to one internal HR web application from a personal laptop. The architect requires that the contractor's other local traffic stays off the corporate network, that the application stay unreachable from the public internet, and that device health be verified at the moment of authorization for every session. Which access design meets the zero trust network access requirements?
- A retailer froze the settings of a broad Block rule under change control, so its action and objects are locked even though rule order in the policy can still be edited. A partner API Allow rule added last release sits below that block rule, so partner requests keep landing in the block while the policy default remains Block all. Which change to the access control policy makes the partner flow match its intended rule?
- An engineer uploads a custom Snort rule to the FMC to catch an attack against an in-house protocol, adds it to an inline intrusion policy, and deploys the access control policy. Users then report the exploit still reaches the server. Which configuration step makes the custom rule drop matching packets?
- A customer wants 200 contractors to reach a single internal HR portal. The laptops are unmanaged, many people connect from outside the corporate network, and the security team insists that access is granted per person and only after the device is confirmed healthy. The team wants browser-based access to just that one application, with no VPN client or network-level access granted. Which remote access design should you deploy so that only a named, healthy contractor can open that portal?
- A retailer added the payment-server subnet 10.48.12.0/24 last month. Connection events from those servers appear in the event viewer, but the servers never show up in the network map and have no host profile. Network discovery has been enabled on the inside interface all along, and its rules still cover only 10.48.0.0/22. Which change restores host and application visibility?
- A hospital is onboarding ten new FTD appliances into one FMC. The hardening standard requires identical NTP servers, DNS servers, and a login banner on every device, and operations wants FMC to raise alarms when CPU, memory, or disk use crosses a limit or an interface goes down. Which two policies should the administrator assign?
- A team is migrating its Secure Firewall Threat Defense sensor from Snort 2 to Snort 3, and the lead engineer wants the operations group to understand what changes in configuration style and process behaviour. The design review also has to explain how packet work is spread across CPU cores on the new engine. Which statement correctly describes the Snort 3 architecture relative to Snort 2?
- Your team is moving from an older Firepower release that ran Snort 2 to a current Secure Firewall Threat Defense deployment running Snort 3, and the architects want to know what changes inside the inspection engine. Which statement best describes the Snort 3 architecture compared with Snort 2?
- A logistics firm runs a proprietary telemetry protocol over cleartext TCP on a port that changes every quarter, and several other applications share that same port range. The team needs the protocol named in network discovery events so it can later write an acceptable-use rule. Which configuration in Secure Firewall Management Center will identify the proprietary application reliably?
- A bank's analysts find that some staff machines resolve freshly registered malware domains and then connect straight to the IP addresses, sidestepping domain controls. The team must answer malicious DNS queries with a sinkhole from the firewall, drop known-bad IP ranges before access control rules are evaluated, and keep legitimate subdomains of the same zones resolving normally. Which DNS and Security Intelligence design meets all three requirements?
- An e-commerce firm ingests daily feeds of hostile IPs, URLs and DNS names and wants every entry stopped before any access control rule is evaluated. Its partner's storefront sits behind changing cloud addresses, so the exception must match on the domain. Which Security Intelligence design should the team deploy?
- During a firewall change review at a logistics firm, an engineer sees that a manual NAT rule covering the whole 10.40.0.0/16 subnet, placed before the automatic NAT section, supplies the translation for a server session, even though an automatic NAT rule on that server object matches the same session and is far more specific. Which FMC NAT evaluation behavior explains this outcome?
- A university deploys an FTD inline and attaches an intrusion policy to an access-control rule. A permitted connection is later dropped by an inline Snort rule, and the engineer must explain which engine handled each stage. Which statement best describes Lina and Snort processing on this traffic?
- A security architect is documenting packet handling on a Secure Firewall Threat Defense device for a design review. One engineer says inspection happens before the stateful engine builds the connection, while another says Snort acts as a reporting-only tool in every deployment mode. Which statement about the path through the Lina and Snort engines is correct?
- A hospital SOC sees one infected workstation raise repeated web-server attack events against six different internal servers inside a 10-minute window, landing as dozens of separate alerts in the Management Center. The lead wants one triage item per burst. Which correlation configuration produces that single item?
- At a regional insurance office, paralegals and claims adjusters share three DHCP subnets, but only members of the Paralegals directory group may open the client-file share, while adjusters on the same addresses must be blocked. Contractor laptops in the guest VLAN never sign in to the directory yet must reach the internet, and the policy's default action blocks everything else. How should the user-to-IP mapping and network matching be arranged for these two groups?
- A 600-user hospital group needs user-based access rules in Secure Firewall Threat Defense. Staff authenticate with domain credentials through 802.1X on wired and wireless networks and Cisco ISE records each session, so usernames must attach to their addresses promptly as people move between wards. Which identity source should supply the user-to-IP mapping?
- A data center team reports that intrusion alerts fire when an HTTP request fits in one TCP segment but go quiet when the request is split across several segments, while alerts for single-packet UDP traffic under the same policy keep firing. Packet captures confirm the split requests arrive intact on the monitored interface. Which network analysis policy component should the team verify first?
- A hospital runs FTD in routed mode between its user VLANs and the WAN edge. The team added a QoS rule constrained to the WAN interface to police overnight backup replication, but the counters show no drops, and the backups are matched early by a prefilter rule whose action is Fastpath. Which Threat Defense QoS behavior explains the missing policing on this backup traffic?
- A regulator asks the security team to prove that a stolen copy of the FMC backup is unreadable without a secret the administrators keep offline, and that one restore point rebuilds the access-control policies, objects, and device registrations. The team currently copies the backup file to a file server after every change. Which FMC backup practice satisfies both requirements?
- A hospital forbids TLS decryption for patient-privacy rules but suspects a workstation is talking to a command-and-control server over HTTPS. The team wants to characterise that connection without seeing any payload. Which information does the Encrypted Visibility Engine provide for the session?
- An engineering firm runs a legacy order service that produces large fragmented IPv4 traffic across its data center segment. Intrusion events never appear for this service even though an intrusion policy is attached to the rule, and packet captures show fragments arriving but no reassembled datagrams handed to the inspection engine. Which network analysis policy adjustment should be made?
- A finance firm's Management Center writes events that lag the SIEM by an offset that stays identical all year, and its own scheduled jobs and certificate validation fail near midnight. The management subnet may reach only the two internal time servers. Which system time configuration should the engineer set?
- A retail chain must inspect TLS sessions to its payment CDN with intrusion rules, but partner banking apps use certificate pinning and would drop a re-signed certificate. One legacy store terminal also uses a self-signed client certificate for mutual TLS. Which Decryption policy configuration meets all three requirements?
- A 60-person contractor program must connect with the Cisco Secure Client client on company laptops, authenticate against the internal RADIUS server, and reach only internal application subnets while personal internet traffic stays local. The same FTD must also build an IKEv2 tunnel to a branch office peer. Which FMC VPN configuration fits both requirements?
- A security team runs an intrusion policy in monitor mode on a managed FTD device and wants newly published detection rules to reach it automatically every night, without an engineer signing into the Management Center. Which update type under the Management Center's content updates should the team schedule to deliver that rule content?
- A lead is standardizing definitions across several FTD devices so that shared policies behave predictably while each device still classifies its own internal network correctly. Considering the FMC object types network, port, URL and variable set, which pairing of object type and everyday use is correct?
- For an upcoming audit, payroll and banking SaaS sessions on the inside zone must be decrypted so the web and intrusion policies see clear text. Pinned mutual-TLS health agents must keep connecting, and endpoints must show no certificate warnings. Which decryption policy arrangement meets all three requirements?
- A two-person team runs 30 FTD devices from one Management Center. In the next maintenance window they need fresh intrusion signatures and vulnerability data loaded, while the device software version stays exactly as it is. What sequence applies a new rule and VDB update to a managed FTD device?
- An engineer protecting a data center adds a rule that drops traffic from a compromised server to a known command-and-control range, but a higher rule allows the entire server subnet to any destination and matches first. Unmatched data-center traffic must still be dropped by the policy default. Which access control policy change produces both behaviors?
- A manufacturer's new SCADA segment is routed through Secure Firewall Threat Defense and traffic flows normally, yet the discovered host and application lists come back empty for that subnet. The team wants the inventory limited to that segment so analysis load on the management center stays contained. Which configuration step produces the host and application visibility they need?
- A campus team must inventory every host and application on the guest Wi-Fi VLAN and the data-center VLAN, profiling only those two segments. Privacy rules forbid identifying individual users on the guest network. Which discovery rule scope and detector settings should you configure?
- A custom Snort rule the team wrote to spot an internal admin protocol sits in the FMC rule library but never fires, although matching traffic crosses the firewall daily. It must drop in the production intrusion policy and stay alert-only in the lab policy, and the two policies run behind different access control rules. Which rule-state configuration across the two policies makes both environments behave correctly?
- A hospital must give three outside billing vendors access to one claims web app. The app must stay hidden from the public internet, every new connection must recheck identity and device health, and vendor reach must stop at that single application. Which application access design meets all three requirements?
- At a logistics company the FTD access control policy lists, in order: allow the branch subnet to the server farm on any TCP port with logging, block any source to the server farm on TCP 3389, then allow the server farm out to update servers. A warehouse host opens an RDP session to a print server in that farm. Which access control rule action ultimately governs that RDP session?
- A fintech firm's threat feed names a domain used for command-and-control callbacks and a set of source ranges behind repeated scans. The engineer must stop DNS lookups for that domain at the DNS layer, drop traffic involving those ranges automatically, and avoid maintaining a separate address object for each range. Which DNS and Security Intelligence configuration meets all three requirements?
- A regional hospital is onboarding its first Secure Firewall Threat Defense appliance into the Secure Firewall Management Center. During TLS decryption, clients must trust the presented certificate from the root stores they already have, the SIEM must receive device logs, and operations wants FMC alerts when interface or HA status degrades. Which certificate, platform settings and health policy choices meet all three needs?
- A branch must stop users from reaching known command-and-control domains and also block a large hostile address range at the edge. The team wants name lookups to return an address they control so connections go to that address instead of the malicious destination, and the range blocked no matter which protocol carries the traffic. Which combination of policy controls delivers both results?
- A company runs an internal web service on TCP 8443, and a second unrelated service also listens on that port, so port matching alone would tag hosts incorrectly. The traffic never leaves the inside network, and the team wants the application name on discovered hosts so correlation rules can reference it. How should the custom application detector be defined and scoped?
- A team moving its FTD 7.x sensors from Snort 2 to Snort 3 has tuning guides written around preprocessors in a network analysis policy, and the leads want to know how inspection work is organized in the new engine. Which statement about Snort 3 architecture on Threat Defense is accurate?
- A fintech runs an internal package registry at pkg.corp.example that resolves to rotating cloud addresses, and every session to it is HTTPS with no decryption configured. The team wants each session tagged with a named application so it can chart registry usage. Which configuration tags that traffic despite the encryption and the changing addresses?
- A SOC lead sees one workstation trigger the same low-severity intrusion signature dozens of times in an hour, with every single event sitting below the team's escalation threshold. They want Secure Firewall Management Center to raise an alert when that pattern accumulates past a set count within a specified time period. Which correlation configuration should the analyst build to escalate the repeated-event pattern?
- A hospital security team keeps seeing one internal server produce low-severity intrusion events all day, and every alert is dismissed on its own. Their correlation policy's default priority is low. They want a single high-severity escalation that emails the on-call engineer the moment a matching event arrives from that server. Which correlation policy configuration should the team deploy?
- A 400-seat manufacturer wants access rules that allow only Finance Active Directory group members onto the ERP servers. Staff already authenticate to the wired network with 802.1X through Cisco ISE, laptops must stay free of agents, and the policy rules out any user sign-in prompt. Which identity source design supplies both the Finance group list and the user-to-IP mappings?
- A payroll server must be reachable only by members of the Finance Active Directory group. The site has 400 domain-joined laptops, runs without any ISE deployment, and holds a strict policy that authentication prompts and added connection delay are unacceptable for these users. The Management Center runs release 7.6 or later with Snort 3 on its devices. Which identity policy configuration supplies the user-to-IP mapping the access rule needs?
- A retail payments team enables an intrusion policy that blocks connections on the access control rule allowing traffic to the card processing tier. Within the hour, users report that sessions stop mid-transfer, and connection events show the flows blocked by the firewall even though the access control rule permits the subnet. Which statement explains how that block is enforced across the Threat Defense engines?
- A partner registers one public address for an app server and refuses sessions that arrive with translated source ports, while that server's existing auto NAT rule port-translates every session to the outside interface. The team needs a fixed one-to-one mapping for partner traffic only, with the auto NAT preserved for all other clients. Which NAT rule placement should they configure on the Threat Defense device?
- At a branch with a single 300 Mbps internet uplink, night-time cloud backup streams saturate the FTD's outside routed interface and voice calls turn choppy. The engineer wants the backup application capped at 150 Mbps without touching other allowed sessions, but a prefilter rule currently fastpaths that application and a site-to-site VPN also terminates on the box. Which configuration change makes the rate limit take effect?
- A security audit lists four FMC findings: management access is open to a whole subnet, backups exist only on the appliance, updates are applied whenever someone remembers, and the FMC rejects external TLS peers' certificates as outside their validity window while its logs arrive an hour out of step. The engineer must clear the finding that breaks certificate validation and time correlation first. Which FMC time configuration should they correct first to clear the certificate and correlation finding?
- A bank's policy forbids installing trusted certificates on user devices, so TLS decryption is off the table, yet engineers still need to spot an unusual client application and a bad certificate on outbound encrypted sessions. Which inspection approach should they enable on Secure Firewall Threat Defense to identify this traffic from metadata alone?
- A hospital's medical-imaging VLAN raises a stream of preprocessor events even though the traffic is legitimate, and the security lead wants the tuning to reach only that VLAN while every other VLAN keeps the default preprocessing, running entirely on the existing appliance. Which network analysis design should scope the preprocessor adjustment?
- A bank's security team must learn which client applications on user endpoints are opening TLS sessions through its FTD devices, but a compliance rule forbids terminating TLS with a man-in-the-middle decryption policy. The FMC manages Snort 3 devices. Which control gives the team client-application visibility into those encrypted sessions?
- A security team at an online retailer keeps watching their HTTP intrusion rules miss obvious command-and-control URLs even though packet captures show the exact request on the wire, split across overlapping TCP segments with mixed-case headers. Which network analysis setting in Secure Firewall Threat Defense should they tune so the request reaches inspection in a consistent form?
- A branch rollout needs one access control rule to match an external partner site by name even though its addresses change weekly, to allow a partner server by host address, and to use a TCP port list that twelve other rules already share so one edit updates every rule. Which combination of network, port and URL objects satisfies all three requirements?
- A company runs one shared access control policy across twelve FTD devices, and the object INTERNAL-DNS must resolve to 10.0.0.53 on branch units but 10.1.0.53 at headquarters. Which object setup keeps the policy shared while giving each device the right address?
- A security engineer sets up one Secure Firewall Threat Defense appliance for two VPNs: Cisco Secure Client remote access for 50 mobile employees and an IKEv2 site-to-site tunnel to a partner that authenticates with a pre-shared key. The site has no RADIUS server, and every remote client must receive an address from a pool defined on the FTD. Which configuration supplies those client addresses?
- A hospital system must inspect decrypted web traffic for malware and intrusions across its business subnets, while personal banking and healthcare portal sessions stay encrypted and remain fully reachable for staff. The decryption policy is new, and the team wants one ordered rule set the Management Center evaluates predictably. Which decryption policy design satisfies these requirements?
- A hospital must inspect outbound TLS payloads for command-and-control while certificate-pinned patient portals and staff banking apps keep working untouched. Endpoints are domain-joined Windows workstations, and the design must rely only on infrastructure the hospital already owns. Which TLS decryption design meets these requirements?
- A university security team must refresh the vulnerability data behind the intrusion policies on three Threat Defense devices. Every change has to flow through the Management Center, nobody may touch the appliances during the change window, and the fresh data must be live on all three by the end of it. Which update sequence delivers the new vulnerability data to the devices?
- A data center access control policy on your FTD has, near the top, a rule allowing every internal subnet to reach the new file server on TCP 445. Lower in the same policy, a rule sends TCP resets for the contractor VLAN's traffic to that server, yet contractors report the share still opens. Which change to the access control policy makes the contractor restriction take effect?
- A production team must tune inspection for their application. They must start from the built-in base intrusion policy, add a custom rule for their home-grown software, and have blocking take effect on live traffic. Which intrusion policy setup meets all three requirements?
- A logistics firm wants external mechanics to reach one web-based maintenance portal while keeping their devices off the plant network. Security requires identity checks, device posture re-evaluated on every session, and reach limited to that single application. Which access design best fits the zero trust network access model?
- A SOC analyst has written a custom Snort rule that flags an internal host beaconing to a known command-and-control domain. Three requirements apply: the custom rule must raise alerts, every other rule in the current intrusion policy must keep its base-policy state, and the change must reach the FTD device today. Which intrusion policy change meets all three requirements?
- A hospital just added a VLAN of infusion pumps that stay quiet between measurements. The team needs an inventory that probes only that new VLAN's address range for each pump's operating system and identifies applications observed from pump traffic. Which network discovery setup provides that visibility?
- During a compliance audit, a hospital must show which operating systems and server applications exist on a monitored VLAN. The FTD receives a copy of that VLAN's traffic on a passive interface, TLS on that segment stays encrypted, and the inventory must come from what the firewall already sees. Which Secure Firewall Management Center configuration produces the host and application inventory the auditor asks for?
- A small team manages five FTD appliances and must keep their syslog, NTP and login banner settings identical with a single edit later, run the same interface and process health checks on all five, and install a company CA-signed certificate on each appliance. Which configuration approach covers all three needs?
- An auditor raised three findings on a hospital's Secure Firewall deployment: the Management Center still serves its default browser certificate, device time and syslog must come from one shared policy, and every appliance needs a defined health policy. Which device management configuration closes all three findings?
- A logistics firm runs an in-house scheduling app on TCP 9443, and an unrelated service also listens on that port. The team wants the FMC network map to record the app from live traffic by matching a marker at the start of each session while servers stay unmodified. Which configuration should the engineer create to identify this application in network discovery?
- Your team is evaluating the migration of an intrusion policy from Snort 2 to Snort 3 on a Secure Firewall Threat Defense device. The security lead wants a reviewable configuration source, efficient use of CPU cores, and the ability to add detection logic without rebuilding the engine. Which Snort 3 architectural change best supports those goals?
- During a ransomware incident, engineers must drop connections to command-and-control servers that Cisco Talos rates as malicious before analysts have catalogued them. Traffic reaches those hosts directly by IP address, the approved access control policy is change-frozen so any fix must sit outside its rule set, and the block must hold even where the matching rule has IPS inspection switched off. Which Threat Defense control should enforce this block?
- A manufacturer built an in-house parts catalog served over plain HTTP on TCP 8443, and it is absent from the system-provided detector list. Two other unrelated services also listen on TCP 8443 in the same segment. The SOC wants the catalog to appear in the discovered application inventory for event views and correlation. Which custom application detector design fits this requirement?
- A web client times out and a packet capture on the egress interface of a Secure Firewall Threat Defense device shows nothing. The access control rule allows the traffic, and an inline intrusion policy attached to that rule logged an event just before the failure. Which factor in the Snort and Lina processing path explains where the packet was stopped?
- A hospital's Threat Defense appliances run release 7.6 and must apply access-control rules based on Active Directory group membership. The Windows team allows one lightweight agent on an approved member server, forbids installing software on domain controllers, and forbids the appliance from polling domain controllers directly. The hospital runs no Cisco ISE. Which identity source should populate the user-to-IP mapping table?
- An FMC-managed FTD publishes an API server at 10.5.20.10, whose object already carries static auto NAT to 203.0.113.10 for every source. Traffic from the partner subnet 198.51.100.0/24 must reach the same server through 203.0.113.14 instead, with no extra hardware allowed. Which NAT design in the FMC NAT policy guarantees both mappings?
- A healthcare SOC wants an early warning when a workstation first contacts an external address on the Security Intelligence list set to Monitor, then starts scanning internal subnets later the same day. Both signals are logged today but sit in different views, so nobody sees the sequence. Which correlation design raises one alert for that workstation?
- An FTD publishes a web server at 10.10.5.20 through 203.0.113.20 while inside hosts need PAT for internet access. During a maintenance window, a broad manual rule that PATs any source to the outside interface address and matches both outbound and inbound packets was added to the NAT policy. Internet users then stopped reaching the published address while outbound access kept working. Which change to the NAT policy restores the inbound translation?
- During a pilot the SOC wants a correlation rule that fires only after a pattern repeats inside a fifteen-minute window, then emails the duty address and launches a scan of the offending host, with no traffic blocked while tuning continues. Which correlation policy configuration satisfies every requirement?
Management and Troubleshooting (25%) · 75 questions
- A SOC lead at a regional bank wants one Management Center view showing only intrusion events from the card-payment VLAN across both firewalls, plus last week's top events as a PDF emailed to compliance every Monday. Which FMC setup delivers the live view and the automated report together?
- A security operations lead must send a weekly threat report to the compliance committee every Monday at 06:00, including event data filtered to match the team's Secure Firewall Threat Defense dashboard views. The report must reach an external distribution list without manual export each week. Which reporting capability in Secure Firewall Management Center should the lead configure to automate this delivery?
- A data center pair of Threat Defense devices silently drops traffic from a freshly migrated VLAN, yet a recheck of the deployed access control policy shows that subnet permitted. The engineer needs to see which firewall engine phase discards those packets, and the investigation has to stay brief enough to leave production traffic undisturbed. Which troubleshooting technique should reveal that firewall engine phase on the live appliance with minimal disruption to production?
- Your SOC at a 400-person logistics firm must reconstruct what one suspicious laptop did last Tuesday. The FMC holds connection records showing DNS queries to an unknown host and an intrusion event from the same source. The analyst needs a single time-ordered view linking those records rather than separate exports. Which view in Secure Firewall Management Center should the analyst open to correlate those events by host and time?
- A retail chain pushes an access control policy change from the Management Center to twelve devices at 02:00. At 06:00 the NOC still sees traffic matching the old rule, and the affected device shows a green status in the health monitors with no error banners anywhere. Which Management Center view confirms whether the policy push completed on that device?
- After replacing a sensor, an engineer pushes a new access control policy from the Management Center. The device shows a healthy indicator on the Health dashboard, but users report that traffic still follows the old rule. Which record in the Management Center confirms whether that policy push actually completed on the sensor?
- A security engineer reports that all policy traffic through the FTD passes and connection events are being logged, but the firewall itself cannot resolve FQDN network objects, so those objects show as unresolved in access control entries. The DNS server sits on the outside network and the firewall sends its queries from its outside interface address. Which packet capture confirms whether the DNS replies reach the firewall's control path?
- An on-call engineer at a branch office must confirm from the device itself which packets arrive on an FTD inside interface while a colleague in the data center reproduces a failed request. The engineer is already logged into the device CLI. Which CLI mode and command give the live capture?
- During a policy outage, a support engineer asks a junior administrator to collect three things straight from the appliance: the applied configuration and connection information as the device reports it, the Linux process listing for the Snort inspection processes, and the free space on the local file systems as Linux reports it. The Management Center only shows high-level health. Which device CLI workflow gathers all three items on the appliance itself?
- A security analyst must give an auditor a list of every discovered host on the claims-floor VLAN that still runs a legacy operating system before the segment is rebuilt next quarter. Threat Defense discovery has been running for six months and active scanning is off limits. Which FMC view should the analyst open?
- A bank sees large file uploads stall halfway through. The access rule permits the traffic and FMC connection events show the flow ended as blocked after inspection, but the team needs the verdict Snort returned for each individual packet. Which FTD CLI troubleshooting tool shows the per-packet Snort verdict for that flow?
- After a switch upgrade, the FMC reports the FTD as unreachable even though both devices sit on the same management VLAN and business traffic still forwards normally. That VLAN also carries backup jobs from other servers, so the capture must stay narrow. Which packet capture should you start to see whether the FTD receives and answers its own management packets?
- The SOC at a logistics firm wants one screen that every analyst opens at shift start, showing the day's blocked hosts and the latest intrusion alerts together. The compliance officer needs the same blocked-connection and intrusion figures emailed to her every Monday morning automatically. Which FMC dashboard and reporting setup satisfies both requirements?
- A credit union must manage 12 Secure Firewall Threat Defense appliances from one place: the management plane must stay inside its data center, one shared access-control policy has to reach every device, and engineers must be able to review connection and intrusion events after an incident. Which management tool fits all three requirements?
- During an outage, an engineer traces a test packet on the FTD from a client to a new reporting server. The output returns a drop reason showing that the route lookup failed for the destination, and the trace ends right there before any NAT or inspection section is printed. Which reading of the packet tracer output is correct?
- A SOC analyst at an e-commerce firm investigates one host that raised an intrusion alert, then flagged a malware download, then opened a suspicious follow-up connection within a five-minute window. Paging through separate event lists slows the timeline work down. Which FMC view puts that host's connection, intrusion, file and malware entries on one screen?
- A fintech security team must send its auditors a weekly PDF of blocked connections and intrusion alerts across twelve FTD devices, using the same event filters each time, and the file must arrive on its own. Two weeks of dashboard screenshots were rejected as evidence. Which reporting setup in Secure Firewall Management Center should the team configure?
- A security engineer traces a flow in Secure Firewall Management Center from a workstation in the Users zone to an application server in the data center zone. Each phase before policy evaluation reports success, but the trace ends there with a drop caused by a block action, while the permit rule for that server sits lower in the rule list. Which rule placement change will clear the drop at policy evaluation for this traced flow?
- After a routine upgrade, one of twelve Secure Firewall devices stops applying its access control policy while the other eleven keep working. The device still appears in the FMC device list, and the team needs to tell a registration problem from a deployment problem before touching the policy itself. Where should the engineer look first to check device health, registration, and deployment status?
- A warehouse reports that the label printer protocol on TCP 8899 from 10.20.4.11 to 10.20.9.5 sometimes fails to reach its server, and no spare switch ports can be used for mirroring. Which packet captures should the engineer run to check the data path and traffic to the FTD management interface?
- During a live incident, a junior engineer needs to see why one user's connections are dropped by the Secure Firewall Threat Defense engine on a busy production device, and the team wants the trace kept low impact. Which practice should guide how the firewall engine debug is used?
- A senior engineer has approved a short firewall engine debug run on a production Secure Firewall Threat Defense device in a busy data center to chase an intermittent policy drop. The junior engineer wants maximum verbosity for a whole night and expects a huge volume of output. Which practice makes this firewall engine debug session safe and useful?
- After an incident at a branch, a regional bank's analyst must brief the team on every host the system has discovered on that VLAN, grouped so the layout is easy to follow, with each entry opening into the host's details. The brief needs a visual overview rather than a table of log rows. Which FMC view shows the whole segment as one map?
- At a small branch, a nightly job on host 10.4.2.11 sends files to 10.4.9.20 on TCP 445 through the Threat Defense inside interface, and lately the transfer stalls with zero bytes sent. A job timeout is your only clue, so you need frame-level proof of arrival plus the exact point where processing ends. Which two troubleshooting checks confirm arrival on the wire and locate that stopping point?
- A logistics engineer sees routing failures when the FTD appliance reaches for its update server, yet the Management Center still shows the interface as up. The engineer needs to know which path the appliance itself would choose for that destination. Which device CLI command should be run, and in which mode?
- A SaaS provider's API tier drops flows intermittently even though the intrusion event log stays empty. While reproducing the problem, an engineer at the FTD CLI needs the verdict Snort applied to each individual packet, including why one packet passed and the next was dropped. Which FTD tool prints each packet's Snort verdict?
- A plant's Threat Defense appliance drops packets from a legacy SCADA polling tool, yet it raises no alerts and writes no matching connection event. The engineer needs the live Snort decision for each individual packet. Which troubleshooting tool should the engineer use to capture the per-packet verdicts?
- An engineer traces a failed sync from 10.4.18.7 to 10.9.2.41 on TCP 5432 with the FMC packet tracer. The output shows the interface and access control phases passing on an allow rule, yet the trace ends in a drop with the reason no route to host, and the device routing table holds only directly connected networks. Which change resolves the routing drop reported by the packet tracer?
- A payment processor must manage twelve FTD devices from inside its own data center, where firewall management sessions and FMC-to-device control traffic must stay in the building, and it needs shared objects, centralized events, and reports across the fleet. Which management tool should the team standardize on for this fleet?
- Users report that a new file share at 10.20.5.40 on port 445 stopped working after the firewall policy was updated. Connection events show nothing at all for these attempts, and the team wants to find which stage of processing drops the traffic before touching any rule. Which troubleshooting output should they read to locate the phase where the flow stops?
- During an incident review, a SOC analyst needs a single chronological table for one server that mixes its connection events, triggered intrusion events, and file or malware events, instead of three separate event screens. Which FMC event view should the analyst open to review those event types in one table?
- The compliance team needs evidence every Monday that last week's blocked connections for the partner network were reviewed. An analyst currently opens the default Overview dashboard, sets the time range by hand, and exports a screenshot. Which FMC reporting workflow produces that scheduled report automatically with the right filter?
- After a suspected breach, an auditor asks your SOC for one chronological listing, on a single production server, that interleaves blocked connections, intrusion alerts, file-malware hits, and Security Intelligence events across a four-hour window. The auditor wants the sequence of events rather than separate per-type summaries. Which FMC view should the analyst open to give the auditor that single sequence?
- On a production Secure Firewall Threat Defense appliance, a custom TCP application fails every few minutes while every other flow keeps working. The Management Center shows no connection event for the failing five-tuple, so the logs give you nothing. You can reach the device CLI, but the check must run right now without any configuration change. Which on-box CLI tool reveals the firewall engine's own live per-packet decision for that flow?
- A new FTD was added to the Management Center, and it appears in the device list, but the new access control policy has no effect on traffic. The administrator must confirm that the unit is registered, that the deployment actually finished, and that sensors and interfaces are healthy. Where should each of those three checks be made?
- A payment server behind Secure Firewall Threat Defense times out during business hours. The team needs to identify the access control rule for one flow without changing the running policy. Which method can show the rule match, with care taken to limit impact on a busy appliance?
- The FMC reports that a device stopped checking in after a network rewrite, and separately users cannot reach 198.51.100.20 on TCP 443 through that device. The engineer must prove whether control-channel packets from the FMC arrive and whether user traffic reaches the data port, keeping both capture files small. Which packet capture plan covers the control path and the data path with the right filters?
- A hospital security lead searches the Management Center connection events for sessions between the new application server and the database tier and finds none, even though the app team confirms the nightly jobs succeed and a packet capture on the FTD shows the sessions. The server's host profile also lists a detected operating system. Which explanation best fits the missing connection events?
- During patch planning, the team must confirm every server on the 10.30.4.0/24 segment that runs Windows Server so the right images get scheduled. Network discovery has been enabled on that interface for months and the hosts generate regular traffic. Which view in the Management Center should the engineer open to read the observed operating system for each host?
- A web app behind an FTD times out for a few users while the FMC connection event table stays empty for its server, so the engineer needs supported evidence that real packets are reaching the inspection engine on the inside interface. Which Threat Defense method shows those packets where inspection happens?
- A hospital's Threat Defense deployment drops traffic from a new imaging vendor. The connection event shows the drop disposition, but the record carries no rule name and the intrusion event list stays empty. The engineer needs Snort's own reasoning for the dropped packets. Which troubleshooting tool can record Snort's per-packet verdicts?
- A regional bank runs 22 Secure Firewall Threat Defense devices across its branches. The continuity plan requires that policies be applied and reports reviewed during a multi-day loss of internet connectivity, while the security team still wants one shared policy set instead of per-branch edits. Which device management tool best meets both requirements?
- A retailer is replacing eight branch firewalls with cloud-delivered Secure Firewall Threat Defense instances. The team needs one console to build a shared access policy for every branch, with no management VM available in the data center to stand up or patch. Which firewall management tool should the team standardize on?
- An engineer traces a flow that users say is blocked, and the FTD packet tracer returns five phases: capture allow, access-list allow, un-nat allow, route-lookup allow, then an access-list phase listing an access policy rule-id with result drop. The summary line reads Action: drop, Drop-reason: (acl-drop) Flow is denied by configured rule, and no snort phase appears. Which packet tracer phase accounts for the drop, and which component can be ruled out?
- A network team sees intermittent blocks on an internal application and needs to know, for individual packets, whether Snort allowed or dropped each one while the traffic is reproduced. The firewall is in production, so tracing must run only during a short test window, and the check has to happen on the Threat Defense device itself. Which troubleshooting command gives per-packet Snort verdicts under those constraints?
- A compliance manager who has no FMC login must receive every Monday at 07:00 a PDF of the prior week's connection events, malware alerts and access-control rule hits; the organization will retain the emailed PDF as evidence. The SOC separately wants live monitoring widgets on one shared screen. Which FMC feature delivers the manager's recurring report?
- A security engineer is assembling an asset inventory for a segmentation project and needs every internal host seen during the past week, together with its operating system, open ports, and advertised services. The list must come from the FMC rather than from a separate scanning tool. Which FMC view should the engineer use to build this host and service inventory?
- A data-center engineer sees replication traffic dropped by the FTD while packet-tracer on the same addresses returns allow, so the simulation hides the live verdict. They need the actual access control rule and drop reason applied to these production packets, and the box carries peak-hour traffic until the 02:00 change window. Which diagnostic approach should they use to observe the live rule evaluation?
- During an incident review, an analyst must show the connection, intrusion, file, and malware events tied to one internal host on a single ordered timeline for a chosen time range. The manager wants one search instead of four separate report exports. Which reporting view in Secure Firewall Management Center should the analyst use to build the combined event timeline?
- After editing the access control policy, an engineer clicks Deploy on the Management Center and leaves for the night. At handover the reviewer must prove three separate facts: the appliance is still registered to this manager, the push completed, and no health alarm fired overnight. Where should each of those three statuses be verified?
- You added a Secure Firewall Threat Defense appliance to the Secure Firewall Management Center and pushed a new access rule, but the team needs confirmation that the device is registered, that deployment finished, and that the appliance is healthy. The change window closes in ten minutes. Which Management Center pages and device checks give registration status, deployment result and device health?
- At a regional hospital, an imaging workstation at 10.44.8.21 has stopped reaching the DICOM server over TCP 443, and the Management Center shows no matching connection event. You need direct proof of what enters the Threat Defense inside data interface, scoped to that host and service so the capture file stays small enough to send to TAC. Which packet capture configuration will answer the question?
- A security engineer is following up on a risk report that flagged an internal server for repeated outbound connections to an unusual address. The engineer needs to confirm which server applications and operating system FTD has detected on that asset, rather than simply reviewing its traffic history. Which view in Secure Firewall Management Center shows the profiled attributes collected for that host?
- After a merger, an analyst must document every server in a newly discovered subnet: the operating system each host runs, the applications it serves, and the ports those services run on. Which analysis feature in the Management Center should she use for that per-host inventory?
- During a site outage a security engineer has console access to an FTD appliance, but the Management Center is unreachable over the network. They need to confirm interface status and current connections, then look at a suspect system process, using only commands that leave the running configuration untouched. Which division of work between the standard CLI and expert mode fits this diagnosis?
- Users report timeouts reaching an internal application behind a physical Secure Firewall Threat Defense appliance. The inside interface is up with the correct address, and a ping from the appliance to the server succeeds, so outbound reachability looks healthy. Starting from the device CLI, which command and mode confirm whether client packets arrive on the inside interface?
- A hospital's inline Secure Firewall Threat Defense appliance appears to drop packets on an HL7 interface. Connection events log the flow as allowed and the intrusion events table stays empty for it. The engineer needs Snort's pass-or-drop verdict for each individual packet on the wire. Which troubleshooting tool shows those per-packet verdicts?
- A SOC analyst traces a packet from 10.1.5.40 to the database server at 10.9.2.15 over TCP 443 because transactions keep timing out. The output shows the packet entering on the inside interface, a successful route lookup, translation applied by the NAT rule, and a drop whose reason names the access-list phase. How should the analyst interpret this packet tracer result?
- The SOC wants a near-real-time view of threat activity on the wall screen, while the compliance officer needs a PDF emailed on the first of each month covering a fixed window, and everything must come from the Management Center itself. Which dashboard and scheduled report design meets both needs?
- A regional bank runs forty Secure Firewall Threat Defense devices at branch sites and wants every management function delivered as a vendor hosted service rather than software it installs. It needs one console to push the same access control policy to every branch and to confirm compliance across the estate. Which management tool meets those hosting and central policy requirements?
- A SOC lead must send the CISO a recurring Friday summary of intrusion and connection events containing only the fields leadership asked for, and the CISO has no Management Center account. Delivery has to happen on its own each week with nobody exporting files by hand. Which reporting approach meets these scheduled report requirements?
- A bank runs 18 Secure Firewall Threat Defense appliances across four data centers in an air-gapped network with no internet route. The team needs shared objects, one place to correlate events, and health checks for every appliance. Which management tool should the team deploy for this on-premises estate?
- A security analyst at a retail firm must prove whether one suspicious internal host triggered only connections or also attack signatures and malicious files during the same hour. FMC already logs every event type for that segment. Which view or report should the analyst open to put that host's connection, intrusion and malware records on one timeline?
- An engineer working from a runbook written when the platform was still called Firepower must triage an FTD device that stopped receiving policy updates overnight. They need to confirm three things: whether the device is still registered, whether the last deployment job failed, and how the appliance is reporting. Which current FMC locations answer all three checks?
- Before a maintenance window, a bank's engineer must identify hosts in 10.44.8.0/24 that FMC detects as running Windows Server 2016 and verify the services and applications FMC detects for each host. FMC has monitored the segment for months. Which FMC analysis workflow should the engineer use?
- An engineer needs to confirm three things about one FTD appliance after a busy change window: whether it is still registered to the Management Center, whether the saved policy edit has been pushed to it, and whether its health checks are reporting problems. Which set of GUI locations will verify all three?
- During peak hours a payments company watches a vendor's TLS flows disappear, and FMC logs show no connection events for them. You need the exact stage where the packets are dropped, and any extra load on the production device must stay minimal. Which troubleshooting approach pinpoints that engine stage with the least added load?
- A branch's Threat Defense appliance shows a stale status in the Management Center after an overnight circuit change, while traffic through its data interfaces flows normally. Its Management Center connection is configured to use the management interface. The engineer needs recorded proof that the appliance's management traffic is still reaching the Management Center, with a filter so only that exchange appears. Which troubleshooting method provides that filtered proof of management connectivity?
- A network engineer adds a virtual Threat Defense appliance to the Management Center, but the device keeps reporting a communication error while production traffic flows normally on its outside interface. Management traffic uses the management0 interface. The engineer wants proof from the device CLI of whether the manager's exchanges reach it, limited to that conversation. Which capture approach should the engineer use?
- A data center FTD VM shows intermittent loss of reachability on its management link, and the Management Center connection keeps dropping, so GUI-driven tools are unreliable during the window. The on-call engineer needs both the current interface state and packet-level evidence captured directly on the appliance before the outage clears. Which device CLI command sequence gives the engineer interface state and live packet evidence?
- A user reports that connections from 10.14.6.30 to 10.22.9.7 on SMB fail. Packet Tracer output shows capture allowed, the access-list phase allowed the flow, route lookup resolving an egress interface, and the Snort phase reporting DROP with an intrusion rule named in its details. Which control should the engineer change first to clear the drop shown by Packet Tracer?
- A regional bank runs eight Secure Firewall Threat Defense appliances at separate branches. It needs a single management plane that holds one policy source for every device and searches and correlates events from all sites together, and the console must stay inside the bank's own data center. Which management tool delivers that single on-premises management plane?
- A tuned intrusion policy should block a specific exploit, yet sessions continue and the event views show nothing for that traffic. Engineers must see how Snort judged each packet individually, including packets that raised no event, and they must get that answer without opening a Cisco support case. Which troubleshooting tool prints the per-packet Snort verdicts?
- An FTD in a branch office stops checking in with the Secure Firewall Management Center, and the engineer has CLI access to the device. They must first confirm the device address, default route and reachability to the FMC, then read a Linux-level log file to see why registration stalled, and the diagnosis must leave every service running. Which clish and expert mode workflow supports this diagnosis?
- Users report that a file share at 10.5.20.5 stopped responding, so an engineer runs Packet Trace from 10.5.10.24 toward TCP 445. The output shows the access control evaluation matched rule 'Legacy-SMB-block' and blocked the packet, with no intrusion or file sections following. What does this output indicate about the drop reason?
Integration (15%) · 45 questions
- A hospital turns on Secure Malware Defense in the Management Center and attaches a file policy to its outbound internet rule. A brand-new executable arrives that no signature set has recorded, and the team expects it blocked once Cisco's cloud marks it malicious. Which component supplies the file disposition that the sensor enforces?
- A university must inspect files arriving over SMB and HTTP before delivery. Its rule says the Management Center must query the cloud for every file's disposition and cut the connection when the verdict is malicious. Which file policy configuration meets both conditions?
- A regional bank must keep its firewall event history for one year with every record stored inside its own data center, and investigators need the analytics dashboards that correlate events across devices. The team is deciding between on-premises and cloud logging in Security Analytics and Logging. Which Security Analytics and Logging option meets the residency and analytics requirements?
- The SOC at a regional healthcare provider wants Splunk to become the long-term home for FTD events. Analysts must search the previous 30 days of connection and intrusion records immediately after go-live, and new events must keep flowing automatically with no manual export step. Which Splunk integration design should the security lead implement for history and live events?
- A compliance team wants near-real-time firewall events in Splunk for its dashboards. The Management Center sits in a segment that allows only outbound connections, platform policy limits it to Cisco-supported components, and the feed must run continuously. Which Splunk integration method satisfies all three conditions?
- A European bank must keep a searchable archive of traffic and intrusion events inside the country, and its analysts already query an on-premises Splunk cluster located in the country every day. The Management Center local event store serves live triage, but the archive has to outlive it. Which event-logging design satisfies both requirements?
- A software reseller runs a two-week pilot that must record the malware disposition of every installer customers download over clear-text HTTP. Every transfer must finish, and every disposition must come from the cloud. Which file rule action meets the pilot requirements?
- A SOC lead wants the Secure Firewall Management Center to show that a file allowed last week turned malicious later, alongside that file's movement across network hosts and managed endpoints, all tied to firewall events. Which integration delivers those two views inside the Management Center?
- A file that passed inspection last week was identified as malicious by Secure Endpoint on Friday. The SOC wants the FMC to flag the original connection as malicious now and to list every host that already received the file, but the receiving laptops are unmanaged and cannot install any agent. Which Secure Endpoint integration should you configure in the FMC?
- A regional bank must label each eligible file inspected by its Secure Firewall as malicious, good, or unknown, and it wants each available verdict to come from Cisco's threat intelligence rather than a local guess. The sensor has an Internet-allowed management path but very little spare local disk. Which file policy configuration in Secure Firewall Management Center should the engineer enable?
- A global retailer wants its security operations team to watch Secure Firewall Management Center connection events, discovery events, and intrusion alerts in an existing Splunk index, with every event encrypted in transit and delivered as a single feed that AI-driven threat intelligence can triage. Which forwarding design should the team configure on the Management Center?
- Your on-premises Secure Firewall Management Center must feed a Splunk instance where analysts run dashboards from the Cisco Security Cloud app. Compliance requires encrypted transport end to end, the management center's own correlation alerts must be searchable, and dashboards must show parsed fields as soon as data lands. Which Splunk collection design meets all three requirements?
- A financial services SOC subscribes to a TAXII feed from its intelligence vendor and wants malicious infrastructure blocked on Secure Firewall Threat Defense within minutes of each feed update, with no access or intrusion policy edits after refreshes. Last quarter several IPS rules drifted out of date. Which Threat Defense configuration enforces blocked observables from the feed automatically?
- A health insurer found that a PDF allowed by its Secure Firewall policy was later judged malicious by Secure Endpoint. Some branch PCs run without a Secure Endpoint agent, and the incident lead needs every host that received the file plus when its verdict changed. Which file-analysis view in FMC should the analyst open to trace the spread?
- A logistics firm enables Secure Malware Defense in the Management Center to protect employee web and email traffic. Files must be checked against the cloud for a verdict, only files reported malicious may be blocked, and both HTTP downloads and SMTP attachments are in scope. Which file policy configuration should the engineer apply?
- A financial services SOC receives its industry group's threat intelligence feed every hour, but analysts still paste indicators into the FMC block list by hand. Security leadership wants traffic matching observables in that feed blocked automatically when those observables are encountered. Which Threat Intelligence Director configuration delivers that automation?
- A company's Secure Firewall Management Center must inspect PDF and PE files arriving on the web proxy segment and decide their disposition. Files larger than 20 MB are already rejected upstream, and the team needs candidates with no usable signature checked against cloud reputation rather than passed through silently. Which file policy configuration submits each candidate for cloud lookup and blocks files returned with a Malware disposition?
- A healthcare firm runs FTD at the perimeter and Secure Endpoint on 800 Windows laptops. Analysts need to see, from the Management Center, when a file the firewall judged malicious later shows up on a laptop, and to follow that file's journey across the network. Which integration provides both?
- A partner security team publishes command-and-control indicators as a STIX/TAXII feed that refreshes hourly, and every observable in it is an IPv4 address. Three FTD devices behind one Management Center must drop matching perimeter traffic with no manual list upkeep as the feed changes. Which Threat Intelligence Director setup meets the feed requirement?
- A manufacturer's Secure Firewall Management Center is integrated with Cisco Secure Endpoint. A signed installer passed the file policy on Monday, and on Wednesday Secure Endpoint flagged the same file as malicious on one workstation. The SOC lead wants every host that already received that file. Which capability in FMC answers that request?
- Three weeks after the gateway allowed a document, Secure Endpoint reports its hash as malicious on one workstation. With the Management Center integration in place, the responder must list every host the firewall has seen receive that same file this month. Which FMC capability should the responder open?
- Your SOC wants one place where a firewall connection event, a Snort alert, a Secure Endpoint detection and an Umbrella DNS request can appear on a single incident timeline for triage, while access-control policies stay under Management Center management. Which XDR integration design meets those needs?
- A SOC analyst is following a workstation that triggered a Command and Control alert in the Secure Firewall Management Center. The same workstation also produced a malware detection on Secure Endpoint and repeated suspicious lookups through Umbrella within the same hour, but each console shows only its own piece. Which Cisco capability should bring these three detections into one investigation?
- A security architect is documenting how pxGrid behaves when Secure Firewall Management Center consumes user and endpoint context from Cisco ISE. The notes must reflect that a controller coordinates topic access, that identity data originates in ISE, and that the Management Center must authenticate to the controller before it can subscribe. Which description of the pxGrid publisher and subscriber roles is accurate?
- A fintech team ingests two vendor intelligence feeds into the Secure Firewall Management Center using Threat Intelligence Director. The high-confidence feed arrives as a TAXII collection and its traffic must be blocked, the lower-confidence feed should only raise events, and nobody may retype the indicators by hand. Which Threat Intelligence Director action plan applies Monitor and Block correctly?
- A payment processor subscribes to a commercial threat feed delivering command-and-control indicators as STIX objects over TAXII, mostly IPv4 addresses. They want matching inbound connections dropped by Threat Defense each time the feed refreshes, without waiting for a signature update. Which Threat Intelligence Director setup blocks those connections automatically?
- A SOC monitors FTD devices at two sites and also collects alerts from the email gateway and endpoint agents, yet each tool shows only part of the attack. They want one investigation that links firewall events to endpoint, identity, and email data through shared indicators. Which platform provides that cross-domain correlation?
- A retail SOC keeps separate consoles for Secure Firewall Management Center alerts, endpoint detections and network flow records, so analysts stitch timelines by hand during incidents. Leadership wants firewall intrusion and file events joined with endpoint and flow telemetry into risk-ranked incidents that one analyst can triage. Which Cisco capability should the team enable to correlate firewall events with the other telemetry sources?
- A retail chain wants its access control rules on the Secure Firewall Management Center to allow people by name using live context from Cisco ISE, including Security Group Tags. ISE already owns the session directory, and the integration runs over pxGrid. Which publisher and subscriber roles should each product take so the Management Center receives that live identity context?
- A security team runs Secure Firewall Threat Defense at the edge, endpoint protection on servers, and a mail gateway, each on its own console, with no spare data engineers to build and maintain custom log parsers. They need a single incident that ties supported firewall alerts to endpoint and email findings, with response actions across all three domains. Which platform should the team use to correlate the firewall events with that other telemetry?
- A company runs 802.1X access with Cisco ISE, and a managed laptop in an open-plan office has just tripped an intrusion rule the security team judges as a real compromise. They want automatic containment at the access layer so the laptop loses useful network reach even if the user unplugs it and moves it to another desk jack, with a clean way to reverse the action later. Which Rapid Threat Containment response should the FMC issue?
- A customer with Cisco ISE deployed wants logged-in Active Directory user names to appear in FMC connection events and to work as conditions in access-control rules. The ISE pxGrid service is already enabled, and the team argues about which device takes which pxGrid role. Which statement correctly assigns the publisher, subscriber and controller roles in this design?
- A security operations team adds a STIX TAXII feed of command-and-control infrastructure to the Management Center. They want IP observables blocked on the managed devices, domain observables from the same feed monitored only, and one internal server address that appears in the feed treated as a false positive. Which Threat Intelligence Director configuration delivers those three behaviors?
- A bank's ISE deployment already maps users to identity groups, and the team wants Secure Firewall Management Center access rules to match on that identity instead of IP addresses. ISE already runs pxGrid with its controller enabled. Which pxGrid role assignment delivers the identity context to the Management Center?
- A regulated bank must keep firewall events inside its own data centers for many years, well past what the FMC database holds, and it wants Cisco's own analytics rather than another third-party platform. Which Security Analytics and Logging option meets those requirements?
- A retail SOC keeps seeing blocked outbound connections on its Secure Firewall Threat Defense and needs to know whether any workstation reached the command server before the block. Endpoint and identity alerts also arrive every day in separate consoles. Which Cisco XDR capability gives analysts one cross-telemetry investigation view?
- The security team wants access control rules in Secure Firewall Management Center to match on live Cisco ISE session context — the authenticated user, the device type, and the Security Group Tag — instead of static address objects. ISE 3.x is already in production. Which pxGrid publisher/subscriber design lets FMC consume that context as ISE publishes it?
- A hospital security team sees a correlation event showing a lab workstation talking to a known command-and-control address. The workstation holds a valid 802.1X session through Cisco ISE, and policy requires it to land in a quarantine VLAN where it can still reach the patch server. The response must fire from the event itself rather than from a timer. Which Rapid Threat Containment action should the team configure?
- Your campus SOC detects command-and-control traffic from a wireless endpoint in a residence hall, and your Secure Firewall Management Center (FMC) is ready for Rapid Threat Containment. The segment never crosses the Threat Defense appliance, containment must start automatically when the event is processed, and the endpoint's live network access must be cut. Which Rapid Threat Containment action meets all three requirements for this host?
- In a campus rollout, Cisco ISE holds live user sessions and security group tags while the Secure Firewall Management Center needs that context for its access rules. pxGrid brokers the exchange through a trusted controller. Which role does the Management Center take in this pxGrid exchange?
- A financial-services SOC sees a Snort event on an FTD sensor showing malware callbacks from a Windows laptop on an 802.1X-enabled floor network. Company policy says the laptop must be cut off at the access layer within seconds, wherever it is plugged in, and the site already runs Cisco ISE with pxGrid connected to the Secure Firewall Management Center. Which Rapid Threat Containment action isolates the endpoint?
- A security engineer needs Secure Firewall Management Center alerts and connection events to reach Splunk near real time, with decoded source, destination, application and user fields preserved for AI-driven correlation. Which Management Center output method best meets these needs?
- A workstation in the finance VLAN trips a Snort rule and the SOC wants its network access reduced within seconds. The team already runs Cisco ISE with authorization profiles for restricted access, and this workstation authenticates through 802.1X and MAB. Which Rapid Threat Containment action should the Management Center take to restrict the endpoint?
- A retail chain runs three Threat Defense devices in separate regions, and auditors must be able to search a full year of connection events even though each Management Center database is near capacity. Management has frozen spending on any new on-premises log servers. Which Security Analytics and Logging design keeps the full audit year searchable without new on-premises servers?
- A security lead must tell auditors where firewall event data physically sits for each Security Analytics and Logging flavor, the on-premises option or the SaaS option. Which statement about storage and analysis for these two options is correct?
These questions are original practice material and are NOT actual exam questions or brain-dump content. Cisco Systems, Inc. and related marks are trademarks of their respective owners. This material is not affiliated with, endorsed by, or sponsored by Cisco Systems, Inc..