Configuration (30%)

SNCF · 90 questions

• A security architect is writing the configuration standard for a new deployment of Secure Firewall Management Center with three FTD devices, and events must correlate cleanly across the whole system. Which configuration aligns the Management Center clock with the clocks of the registered devices?
• A payment processor runs a Secure Firewall Management Center (FMC) with sensors in three regions. The auditor requires that FMC and sensor event timestamps match the enterprise SIEM, that configuration is captured before every change window, and that only named administrators reach the GUI. Which FMC system setting satisfies the shared timestamp requirement?
• A customer wants to spot command-and-control traffic inside TLS sessions but has ruled out decryption, so they ask what the Encrypted Visibility Engine actually looks at. Which detail from the TLS handshake does EVE use to identify the application?
• A branch office runs voice and video over a single 100 Mbps uplink that saturates during nightly backups, making calls choppy. The budget allows only the current link, and the team wants the fix enforced on the Threat Defense appliance rather than the router. Which QoS rule on Threat Defense can limit bulk transfers while leaving real-time media uncapped?
• A branch office carries SIP voice, a video-conferencing subnet and large backups to a cloud target across one 50 Mbps ISP link. At 4 p.m. the link saturates and calls break up while the backup keeps flowing, and change control allows only the QoS policy editor. Which Threat Defense QoS design protects the real-time traffic?
• A hospital runs its radiology reporting app as plain HTTP on TCP 8443. FTD is inspecting the server segment, but the app's traffic appears only as a raw TCP stream, so the HTTP decoder never normalizes requests and intrusion inspection misses header anomalies. The team wants this traffic analyzed as HTTP while the app keeps port 8443. Which network analysis policy change should the engineer make?
• A utility's security team reads a Talos advisory about a new remote code execution exploit, and their FTD release is already current and stable. Only content-level updates are approved in this week's change window, and the team wants detection coverage today. Which Management Center content update should be applied first?
• An engineer is adding a rule for partner subnet 10.20.30.0/24 reaching internal servers on TCP 8443, plus a URL condition for a legacy portal. That subnet also sits in a network group holding several other ranges, shared with another policy that must stay unchanged. Which set of object types keeps this rule correct and the other policy untouched?
• A manufacturing firm's policy requires TLS inspection of employee web traffic so IPS and file policies can see inside sessions, while sites that pin certificates, such as corporate banking and government portals, must pass through untouched. The CISO also insists that any session the firewall cannot decrypt is blocked rather than allowed onward. Which SSL decryption policy design should the engineer apply?
• Our sales team of 40 people works from home laptops and must reach only the application servers in 10.20.30.0/24, and the security team requires per-user certificate authentication from the company PKI. Web browsing must keep leaving directly from each laptop, and the FMC already manages an FTD appliance at the data center edge. Which remote access VPN configuration should you deploy on the FTD?
• A hospital network team runs four Secure Firewall Threat Defense devices from one Secure Firewall Management Center. Intrusion prevention signatures must refresh every night, no sensor may reboot because the ward network runs around the clock, and no software upgrade is approved this quarter. Which update approach should they schedule for the nightly intrusion rule refresh?
• A manufacturing customer connects its data center FTD, which has a static public address, to a supplier's firewall that also has a static public address. The supplier contract requires IKEv2 with a pre-shared key, and reachability through the tunnel must be limited strictly to the data center's 10.20.0.0/24 application subnet. Which site-to-site VPN configuration meets every condition?
• A branch maintenance window is running, so a rule blocking the whole branch subnet sits near the top of the access control policy, and the policy default action must stay block all packets. A rule allowing the analytics server was added at the end of the list, but connections to that server are still dropped. Two allow rules below the block open branch traffic to monitoring hosts, and those flows must stay blocked until the window ends. Which access control rule change lets only the analytics server through?
• A contractor needs access to one internal HR web application from a personal laptop. The architect requires that the contractor's other local traffic stays off the corporate network, that the application stay unreachable from the public internet, and that device health be verified at the moment of authorization for every session. Which access design meets the zero trust network access requirements?
• A retailer froze the settings of a broad Block rule under change control, so its action and objects are locked even though rule order in the policy can still be edited. A partner API Allow rule added last release sits below that block rule, so partner requests keep landing in the block while the policy default remains Block all. Which change to the access control policy makes the partner flow match its intended rule?
• An engineer uploads a custom Snort rule to the FMC to catch an attack against an in-house protocol, adds it to an inline intrusion policy, and deploys the access control policy. Users then report the exploit still reaches the server. Which configuration step makes the custom rule drop matching packets?
• A customer wants 200 contractors to reach a single internal HR portal. The laptops are unmanaged, many people connect from outside the corporate network, and the security team insists that access is granted per person and only after the device is confirmed healthy. The team wants browser-based access to just that one application, with no VPN client or network-level access granted. Which remote access design should you deploy so that only a named, healthy contractor can open that portal?
• A retailer added the payment-server subnet 10.48.12.0/24 last month. Connection events from those servers appear in the event viewer, but the servers never show up in the network map and have no host profile. Network discovery has been enabled on the inside interface all along, and its rules still cover only 10.48.0.0/22. Which change restores host and application visibility?
• A hospital is onboarding ten new FTD appliances into one FMC. The hardening standard requires identical NTP servers, DNS servers, and a login banner on every device, and operations wants FMC to raise alarms when CPU, memory, or disk use crosses a limit or an interface goes down. Which two policies should the administrator assign?
• A team is migrating its Secure Firewall Threat Defense sensor from Snort 2 to Snort 3, and the lead engineer wants the operations group to understand what changes in configuration style and process behaviour. The design review also has to explain how packet work is spread across CPU cores on the new engine. Which statement correctly describes the Snort 3 architecture relative to Snort 2?
• Your team is moving from an older Firepower release that ran Snort 2 to a current Secure Firewall Threat Defense deployment running Snort 3, and the architects want to know what changes inside the inspection engine. Which statement best describes the Snort 3 architecture compared with Snort 2?
• A logistics firm runs a proprietary telemetry protocol over cleartext TCP on a port that changes every quarter, and several other applications share that same port range. The team needs the protocol named in network discovery events so it can later write an acceptable-use rule. Which configuration in Secure Firewall Management Center will identify the proprietary application reliably?
• A bank's analysts find that some staff machines resolve freshly registered malware domains and then connect straight to the IP addresses, sidestepping domain controls. The team must answer malicious DNS queries with a sinkhole from the firewall, drop known-bad IP ranges before access control rules are evaluated, and keep legitimate subdomains of the same zones resolving normally. Which DNS and Security Intelligence design meets all three requirements?
• An e-commerce firm ingests daily feeds of hostile IPs, URLs and DNS names and wants every entry stopped before any access control rule is evaluated. Its partner's storefront sits behind changing cloud addresses, so the exception must match on the domain. Which Security Intelligence design should the team deploy?
• During a firewall change review at a logistics firm, an engineer sees that a manual NAT rule covering the whole 10.40.0.0/16 subnet, placed before the automatic NAT section, supplies the translation for a server session, even though an automatic NAT rule on that server object matches the same session and is far more specific. Which FMC NAT evaluation behavior explains this outcome?
• A university deploys an FTD inline and attaches an intrusion policy to an access-control rule. A permitted connection is later dropped by an inline Snort rule, and the engineer must explain which engine handled each stage. Which statement best describes Lina and Snort processing on this traffic?
• A security architect is documenting packet handling on a Secure Firewall Threat Defense device for a design review. One engineer says inspection happens before the stateful engine builds the connection, while another says Snort acts as a reporting-only tool in every deployment mode. Which statement about the path through the Lina and Snort engines is correct?
• A hospital SOC sees one infected workstation raise repeated web-server attack events against six different internal servers inside a 10-minute window, landing as dozens of separate alerts in the Management Center. The lead wants one triage item per burst. Which correlation configuration produces that single item?
• At a regional insurance office, paralegals and claims adjusters share three DHCP subnets, but only members of the Paralegals directory group may open the client-file share, while adjusters on the same addresses must be blocked. Contractor laptops in the guest VLAN never sign in to the directory yet must reach the internet, and the policy's default action blocks everything else. How should the user-to-IP mapping and network matching be arranged for these two groups?
• A 600-user hospital group needs user-based access rules in Secure Firewall Threat Defense. Staff authenticate with domain credentials through 802.1X on wired and wireless networks and Cisco ISE records each session, so usernames must attach to their addresses promptly as people move between wards. Which identity source should supply the user-to-IP mapping?
• A data center team reports that intrusion alerts fire when an HTTP request fits in one TCP segment but go quiet when the request is split across several segments, while alerts for single-packet UDP traffic under the same policy keep firing. Packet captures confirm the split requests arrive intact on the monitored interface. Which network analysis policy component should the team verify first?
• A hospital runs FTD in routed mode between its user VLANs and the WAN edge. The team added a QoS rule constrained to the WAN interface to police overnight backup replication, but the counters show no drops, and the backups are matched early by a prefilter rule whose action is Fastpath. Which Threat Defense QoS behavior explains the missing policing on this backup traffic?
• A regulator asks the security team to prove that a stolen copy of the FMC backup is unreadable without a secret the administrators keep offline, and that one restore point rebuilds the access-control policies, objects, and device registrations. The team currently copies the backup file to a file server after every change. Which FMC backup practice satisfies both requirements?
• A hospital forbids TLS decryption for patient-privacy rules but suspects a workstation is talking to a command-and-control server over HTTPS. The team wants to characterise that connection without seeing any payload. Which information does the Encrypted Visibility Engine provide for the session?
• An engineering firm runs a legacy order service that produces large fragmented IPv4 traffic across its data center segment. Intrusion events never appear for this service even though an intrusion policy is attached to the rule, and packet captures show fragments arriving but no reassembled datagrams handed to the inspection engine. Which network analysis policy adjustment should be made?
• A finance firm's Management Center writes events that lag the SIEM by an offset that stays identical all year, and its own scheduled jobs and certificate validation fail near midnight. The management subnet may reach only the two internal time servers. Which system time configuration should the engineer set?
• A retail chain must inspect TLS sessions to its payment CDN with intrusion rules, but partner banking apps use certificate pinning and would drop a re-signed certificate. One legacy store terminal also uses a self-signed client certificate for mutual TLS. Which Decryption policy configuration meets all three requirements?
• A 60-person contractor program must connect with the Cisco Secure Client client on company laptops, authenticate against the internal RADIUS server, and reach only internal application subnets while personal internet traffic stays local. The same FTD must also build an IKEv2 tunnel to a branch office peer. Which FMC VPN configuration fits both requirements?
• A security team runs an intrusion policy in monitor mode on a managed FTD device and wants newly published detection rules to reach it automatically every night, without an engineer signing into the Management Center. Which update type under the Management Center's content updates should the team schedule to deliver that rule content?
• A lead is standardizing definitions across several FTD devices so that shared policies behave predictably while each device still classifies its own internal network correctly. Considering the FMC object types network, port, URL and variable set, which pairing of object type and everyday use is correct?
• For an upcoming audit, payroll and banking SaaS sessions on the inside zone must be decrypted so the web and intrusion policies see clear text. Pinned mutual-TLS health agents must keep connecting, and endpoints must show no certificate warnings. Which decryption policy arrangement meets all three requirements?
• A two-person team runs 30 FTD devices from one Management Center. In the next maintenance window they need fresh intrusion signatures and vulnerability data loaded, while the device software version stays exactly as it is. What sequence applies a new rule and VDB update to a managed FTD device?
• An engineer protecting a data center adds a rule that drops traffic from a compromised server to a known command-and-control range, but a higher rule allows the entire server subnet to any destination and matches first. Unmatched data-center traffic must still be dropped by the policy default. Which access control policy change produces both behaviors?
• A manufacturer's new SCADA segment is routed through Secure Firewall Threat Defense and traffic flows normally, yet the discovered host and application lists come back empty for that subnet. The team wants the inventory limited to that segment so analysis load on the management center stays contained. Which configuration step produces the host and application visibility they need?
• A campus team must inventory every host and application on the guest Wi-Fi VLAN and the data-center VLAN, profiling only those two segments. Privacy rules forbid identifying individual users on the guest network. Which discovery rule scope and detector settings should you configure?
• A custom Snort rule the team wrote to spot an internal admin protocol sits in the FMC rule library but never fires, although matching traffic crosses the firewall daily. It must drop in the production intrusion policy and stay alert-only in the lab policy, and the two policies run behind different access control rules. Which rule-state configuration across the two policies makes both environments behave correctly?
• A hospital must give three outside billing vendors access to one claims web app. The app must stay hidden from the public internet, every new connection must recheck identity and device health, and vendor reach must stop at that single application. Which application access design meets all three requirements?
• At a logistics company the FTD access control policy lists, in order: allow the branch subnet to the server farm on any TCP port with logging, block any source to the server farm on TCP 3389, then allow the server farm out to update servers. A warehouse host opens an RDP session to a print server in that farm. Which access control rule action ultimately governs that RDP session?
• A fintech firm's threat feed names a domain used for command-and-control callbacks and a set of source ranges behind repeated scans. The engineer must stop DNS lookups for that domain at the DNS layer, drop traffic involving those ranges automatically, and avoid maintaining a separate address object for each range. Which DNS and Security Intelligence configuration meets all three requirements?
• A regional hospital is onboarding its first Secure Firewall Threat Defense appliance into the Secure Firewall Management Center. During TLS decryption, clients must trust the presented certificate from the root stores they already have, the SIEM must receive device logs, and operations wants FMC alerts when interface or HA status degrades. Which certificate, platform settings and health policy choices meet all three needs?
• A branch must stop users from reaching known command-and-control domains and also block a large hostile address range at the edge. The team wants name lookups to return an address they control so connections go to that address instead of the malicious destination, and the range blocked no matter which protocol carries the traffic. Which combination of policy controls delivers both results?
• A company runs an internal web service on TCP 8443, and a second unrelated service also listens on that port, so port matching alone would tag hosts incorrectly. The traffic never leaves the inside network, and the team wants the application name on discovered hosts so correlation rules can reference it. How should the custom application detector be defined and scoped?
• A team moving its FTD 7.x sensors from Snort 2 to Snort 3 has tuning guides written around preprocessors in a network analysis policy, and the leads want to know how inspection work is organized in the new engine. Which statement about Snort 3 architecture on Threat Defense is accurate?
• A fintech runs an internal package registry at pkg.corp.example that resolves to rotating cloud addresses, and every session to it is HTTPS with no decryption configured. The team wants each session tagged with a named application so it can chart registry usage. Which configuration tags that traffic despite the encryption and the changing addresses?
• A SOC lead sees one workstation trigger the same low-severity intrusion signature dozens of times in an hour, with every single event sitting below the team's escalation threshold. They want Secure Firewall Management Center to raise an alert when that pattern accumulates past a set count within a specified time period. Which correlation configuration should the analyst build to escalate the repeated-event pattern?
• A hospital security team keeps seeing one internal server produce low-severity intrusion events all day, and every alert is dismissed on its own. Their correlation policy's default priority is low. They want a single high-severity escalation that emails the on-call engineer the moment a matching event arrives from that server. Which correlation policy configuration should the team deploy?
• A 400-seat manufacturer wants access rules that allow only Finance Active Directory group members onto the ERP servers. Staff already authenticate to the wired network with 802.1X through Cisco ISE, laptops must stay free of agents, and the policy rules out any user sign-in prompt. Which identity source design supplies both the Finance group list and the user-to-IP mappings?
• A payroll server must be reachable only by members of the Finance Active Directory group. The site has 400 domain-joined laptops, runs without any ISE deployment, and holds a strict policy that authentication prompts and added connection delay are unacceptable for these users. The Management Center runs release 7.6 or later with Snort 3 on its devices. Which identity policy configuration supplies the user-to-IP mapping the access rule needs?
• A retail payments team enables an intrusion policy that blocks connections on the access control rule allowing traffic to the card processing tier. Within the hour, users report that sessions stop mid-transfer, and connection events show the flows blocked by the firewall even though the access control rule permits the subnet. Which statement explains how that block is enforced across the Threat Defense engines?
• A partner registers one public address for an app server and refuses sessions that arrive with translated source ports, while that server's existing auto NAT rule port-translates every session to the outside interface. The team needs a fixed one-to-one mapping for partner traffic only, with the auto NAT preserved for all other clients. Which NAT rule placement should they configure on the Threat Defense device?
• At a branch with a single 300 Mbps internet uplink, night-time cloud backup streams saturate the FTD's outside routed interface and voice calls turn choppy. The engineer wants the backup application capped at 150 Mbps without touching other allowed sessions, but a prefilter rule currently fastpaths that application and a site-to-site VPN also terminates on the box. Which configuration change makes the rate limit take effect?
• A security audit lists four FMC findings: management access is open to a whole subnet, backups exist only on the appliance, updates are applied whenever someone remembers, and the FMC rejects external TLS peers' certificates as outside their validity window while its logs arrive an hour out of step. The engineer must clear the finding that breaks certificate validation and time correlation first. Which FMC time configuration should they correct first to clear the certificate and correlation finding?
• A bank's policy forbids installing trusted certificates on user devices, so TLS decryption is off the table, yet engineers still need to spot an unusual client application and a bad certificate on outbound encrypted sessions. Which inspection approach should they enable on Secure Firewall Threat Defense to identify this traffic from metadata alone?
• A hospital's medical-imaging VLAN raises a stream of preprocessor events even though the traffic is legitimate, and the security lead wants the tuning to reach only that VLAN while every other VLAN keeps the default preprocessing, running entirely on the existing appliance. Which network analysis design should scope the preprocessor adjustment?
• A bank's security team must learn which client applications on user endpoints are opening TLS sessions through its FTD devices, but a compliance rule forbids terminating TLS with a man-in-the-middle decryption policy. The FMC manages Snort 3 devices. Which control gives the team client-application visibility into those encrypted sessions?
• A security team at an online retailer keeps watching their HTTP intrusion rules miss obvious command-and-control URLs even though packet captures show the exact request on the wire, split across overlapping TCP segments with mixed-case headers. Which network analysis setting in Secure Firewall Threat Defense should they tune so the request reaches inspection in a consistent form?
• A branch rollout needs one access control rule to match an external partner site by name even though its addresses change weekly, to allow a partner server by host address, and to use a TCP port list that twelve other rules already share so one edit updates every rule. Which combination of network, port and URL objects satisfies all three requirements?
• A company runs one shared access control policy across twelve FTD devices, and the object INTERNAL-DNS must resolve to 10.0.0.53 on branch units but 10.1.0.53 at headquarters. Which object setup keeps the policy shared while giving each device the right address?
• A security engineer sets up one Secure Firewall Threat Defense appliance for two VPNs: Cisco Secure Client remote access for 50 mobile employees and an IKEv2 site-to-site tunnel to a partner that authenticates with a pre-shared key. The site has no RADIUS server, and every remote client must receive an address from a pool defined on the FTD. Which configuration supplies those client addresses?
• A hospital system must inspect decrypted web traffic for malware and intrusions across its business subnets, while personal banking and healthcare portal sessions stay encrypted and remain fully reachable for staff. The decryption policy is new, and the team wants one ordered rule set the Management Center evaluates predictably. Which decryption policy design satisfies these requirements?
• A hospital must inspect outbound TLS payloads for command-and-control while certificate-pinned patient portals and staff banking apps keep working untouched. Endpoints are domain-joined Windows workstations, and the design must rely only on infrastructure the hospital already owns. Which TLS decryption design meets these requirements?
• A university security team must refresh the vulnerability data behind the intrusion policies on three Threat Defense devices. Every change has to flow through the Management Center, nobody may touch the appliances during the change window, and the fresh data must be live on all three by the end of it. Which update sequence delivers the new vulnerability data to the devices?
• A data center access control policy on your FTD has, near the top, a rule allowing every internal subnet to reach the new file server on TCP 445. Lower in the same policy, a rule sends TCP resets for the contractor VLAN's traffic to that server, yet contractors report the share still opens. Which change to the access control policy makes the contractor restriction take effect?
• A production team must tune inspection for their application. They must start from the built-in base intrusion policy, add a custom rule for their home-grown software, and have blocking take effect on live traffic. Which intrusion policy setup meets all three requirements?
• A logistics firm wants external mechanics to reach one web-based maintenance portal while keeping their devices off the plant network. Security requires identity checks, device posture re-evaluated on every session, and reach limited to that single application. Which access design best fits the zero trust network access model?
• A SOC analyst has written a custom Snort rule that flags an internal host beaconing to a known command-and-control domain. Three requirements apply: the custom rule must raise alerts, every other rule in the current intrusion policy must keep its base-policy state, and the change must reach the FTD device today. Which intrusion policy change meets all three requirements?
• A hospital just added a VLAN of infusion pumps that stay quiet between measurements. The team needs an inventory that probes only that new VLAN's address range for each pump's operating system and identifies applications observed from pump traffic. Which network discovery setup provides that visibility?
• During a compliance audit, a hospital must show which operating systems and server applications exist on a monitored VLAN. The FTD receives a copy of that VLAN's traffic on a passive interface, TLS on that segment stays encrypted, and the inventory must come from what the firewall already sees. Which Secure Firewall Management Center configuration produces the host and application inventory the auditor asks for?
• A small team manages five FTD appliances and must keep their syslog, NTP and login banner settings identical with a single edit later, run the same interface and process health checks on all five, and install a company CA-signed certificate on each appliance. Which configuration approach covers all three needs?
• An auditor raised three findings on a hospital's Secure Firewall deployment: the Management Center still serves its default browser certificate, device time and syslog must come from one shared policy, and every appliance needs a defined health policy. Which device management configuration closes all three findings?
• A logistics firm runs an in-house scheduling app on TCP 9443, and an unrelated service also listens on that port. The team wants the FMC network map to record the app from live traffic by matching a marker at the start of each session while servers stay unmodified. Which configuration should the engineer create to identify this application in network discovery?
• Your team is evaluating the migration of an intrusion policy from Snort 2 to Snort 3 on a Secure Firewall Threat Defense device. The security lead wants a reviewable configuration source, efficient use of CPU cores, and the ability to add detection logic without rebuilding the engine. Which Snort 3 architectural change best supports those goals?
• During a ransomware incident, engineers must drop connections to command-and-control servers that Cisco Talos rates as malicious before analysts have catalogued them. Traffic reaches those hosts directly by IP address, the approved access control policy is change-frozen so any fix must sit outside its rule set, and the block must hold even where the matching rule has IPS inspection switched off. Which Threat Defense control should enforce this block?
• A manufacturer built an in-house parts catalog served over plain HTTP on TCP 8443, and it is absent from the system-provided detector list. Two other unrelated services also listen on TCP 8443 in the same segment. The SOC wants the catalog to appear in the discovered application inventory for event views and correlation. Which custom application detector design fits this requirement?
• A web client times out and a packet capture on the egress interface of a Secure Firewall Threat Defense device shows nothing. The access control rule allows the traffic, and an inline intrusion policy attached to that rule logged an event just before the failure. Which factor in the Snort and Lina processing path explains where the packet was stopped?
• A hospital's Threat Defense appliances run release 7.6 and must apply access-control rules based on Active Directory group membership. The Windows team allows one lightweight agent on an approved member server, forbids installing software on domain controllers, and forbids the appliance from polling domain controllers directly. The hospital runs no Cisco ISE. Which identity source should populate the user-to-IP mapping table?
• An FMC-managed FTD publishes an API server at 10.5.20.10, whose object already carries static auto NAT to 203.0.113.10 for every source. Traffic from the partner subnet 198.51.100.0/24 must reach the same server through 203.0.113.14 instead, with no extra hardware allowed. Which NAT design in the FMC NAT policy guarantees both mappings?
• A healthcare SOC wants an early warning when a workstation first contacts an external address on the Security Intelligence list set to Monitor, then starts scanning internal subnets later the same day. Both signals are logged today but sit in different views, so nobody sees the sequence. Which correlation design raises one alert for that workstation?
• An FTD publishes a web server at 10.10.5.20 through 203.0.113.20 while inside hosts need PAT for internet access. During a maintenance window, a broad manual rule that PATs any source to the outside interface address and matches both outbound and inbound packets was added to the NAT policy. Internet users then stopped reaching the published address while outbound access kept working. Which change to the NAT policy restores the inbound translation?
• During a pilot the SOC wants a correlation rule that fires only after a pattern repeats inside a fifteen-minute window, then emails the duty address and launches a scan of the offending host, with no traffic blocked while tuning continues. Which correlation policy configuration satisfies every requirement?