Deployment (30%)

SNCF · 90 questions

• The bank is inserting an FTD appliance between its server VLAN and the internet edge router so traffic can be inspected and controlled. The server subnet keeps its existing addressing, outbound sessions must be translated to the outside interface address, and the appliance must learn remote routes from the router through OSPF rather than from static entries. Which routed-mode configuration should the engineer implement for addressing, NAT, and routing?
• A service provider is replacing a customer's edge router with a Secure Firewall Threat Defense appliance running in routed mode, and its access policy already permits the required flows. Inside hosts with private addresses must reach the internet, the Network Operations Center must reach the appliance's inside interface, and an external partner must reach a private web server. Which routed-mode configuration satisfies all three requirements?
• A branch office replaces its router with an FTD appliance in routed mode. The inside interface faces the core switch, the outside interface faces the ISP router, and the core switch already uses the appliance as its default gateway. The ISP forwards traffic for one public address only. Which configuration completes the routed-mode path for outbound traffic?
• A manufacturer is deploying a Threat Defense appliance in routed mode between the campus core switch and the ISP edge. Internal hosts in the 10.20.0.0/16 network must reach internet destinations, the existing switch and host addressing stay exactly in place, and the provider edge performs no translation for customer subnets. Which configuration set completes this routed-mode deployment?
• A manufacturer is inserting an FTD appliance in routed mode between its core switch and the ISP router. Inside hosts use 10.20.0.0/16, the ISP gives a public /30 for the outside link and routes a public /29 for published services, while four web servers must stay publicly reachable on private addresses. Which routed-mode configuration meets these requirements?
• A bank is placing a Threat Defense appliance between the core switch and the ISP link in routed mode, with private subnets inside and public addresses outside. Engineers must settle addressing, NAT and routing before go-live. Which statement describes how routed mode forwards traffic between its interfaces?
• A retailer wants to add threat inspection between a pair of Layer 2 switches at a store while host addresses and the default gateway stay exactly as they are. The engineer plans to deploy Secure Firewall Threat Defense in transparent mode. Which configuration detail describes how the appliance joins that Layer 2 segment in transparent mode?
• A data center team must insert an FTD appliance between a legacy application server and its access switch without changing the server's IP address, its default gateway, or the subnet's existing routes. The appliance has two interfaces and must still apply access control to the server's traffic. Which FTD deployment configuration meets these Layer 2 constraints?
• A hospital must insert an FTD between two switches carrying 192.168.10.0/24; every host keeps its current address and default gateway, and broadcasts must still cross the link. Management access from the data center has to work as well. Which transparent-mode design should the engineers deploy?
• A regional hospital is inserting an FTD appliance in transparent mode between its core switch and its imaging servers, which must keep their current addresses. A second interface pair connects a partner clinic link that must stay in its own broadcast domain. Which bridge group design meets both requirements?
• A retail chain is inserting an FTD appliance between its access switch and distribution router so the point-of-sale servers keep their current addresses. The appliance must filter at Layer 2 while routing stays elsewhere, keep both segments in one broadcast domain, and hold its management address on one virtual interface in the production subnet. Which FTD deployment mode and interface design satisfies every requirement?
• After moving two campus lab switches behind an FTD appliance in transparent mode, an engineer confirms that the unicast access rules show steady hits. The ARP tables still fill on both sides, yet no rule matches ARP traffic. Which statement best explains how the bridge group handles ARP frames?
• A university is inserting an FTD appliance between its campus core switch and a new research VLAN of 300 hosts. The hosts must keep their existing IP addresses, the appliance must be the segment's default gateway, and the appliance must translate outbound traffic so it leaves through one public address. Which operating mode meets all three requirements for the research VLAN?
• A greenfield branch is being built with two new segments, one for staff workstations and one for a small server rack, and addresses are being assigned from scratch. The architect requires the appliance to act as the gateway for both segments, each segment to arrive on its own physical port, and device management to use a dedicated port. Which deployment mode and interface layout satisfies this design?
• A hospital must protect traffic between its server VLANs, which are routed by the existing router through a Layer 2 switch. The network team requires every server IP address and default gateway to stay exactly as they are, and the existing router configuration is frozen. The FTD has been placed physically between the switch and that router, so all inter-VLAN traffic traverses it, and it must actively block traffic by policy. Which deployment mode meets these insertion requirements?
• A regional hospital must place an FTD in front of a new server farm. The user VLANs and the server subnet are different networks, so the firewall has to route between them; threats must be actively blocked rather than just logged; and every existing host IP address must stay unchanged. Which deployment mode satisfies these insertion requirements?
• A regional insurer must inspect traffic flowing from a core switch into a server farm using one existing Secure Firewall Threat Defense appliance, and the change ticket forbids re-addressing hosts, altering the servers' default gateway, or changing the subnet layout. Which deployment mode best satisfies the ticket's insertion constraints?
• A hospital must insert an FTD between an access switch and the upstream router on a flat subnet during a ninety-minute window. Host addresses, masks and their default gateway must remain untouched, and the firewall must enforce per-host access rules on that same subnet while the management center manages it out of band. Which Secure Firewall deployment mode meets this insertion requirement?
• A teaching hospital must detect attacks on a core switch segment that carries patient monitoring traffic. The switch supports port mirroring, spare appliance interfaces are available, and the team requires packets to keep flowing on time even if the appliance fails or a signature matches. Which NGIPS deployment design should the team implement for this segment?
• A regional hospital must watch for exploit attempts on its clinical VLAN while patient-monitoring traffic stays completely unaffected, and the core switch's mirror session drops frames whenever nightly backups saturate the uplink. The team needs lossless copies of both directions of every conversation with the sensor out of the traffic path. Which passive deployment design satisfies all three requirements?
• A regional hospital has one spare FTD appliance and requires zero disruption to patient-monitor traffic, though its core router team can push ACL updates within minutes. Which SPAN-based passive deployment should the hospital build to keep the FTD out of the production data path?
• A utility operator runs an FTD sensor in passive mode on a switch SPAN port. The sensor raises alerts for known-bad traffic, including a test download that it flagged correctly, yet the sessions still complete and the file is delivered. Which factor most directly explains why the flagged traffic continued to flow?
• A logistics company must inspect both directions of a full-duplex 10-Gbps uplink between its warehouse core switch and the WAN router with a Secure Firewall Threat Defense appliance running in passive mode. Traffic bursts can fill both directions at once, and the appliance reboots during a maintenance window while warehouse operations continue. Which monitoring design fits this passive deployment?
• A university team is piloting Secure Firewall Threat Defense to inspect traffic flowing between its student VLANs and its server VLANs. The core switch stack must keep production traffic forwarding at all times, and the pilot's only approved resource is one spare 10 Gb capture port on that stack. Which passive monitoring deployment design meets every constraint?
• A data center team must place a Secure Firewall Threat Defense appliance inline between the web and application tiers, where attacks must be dropped and a reboot must never interrupt production, and inline before the payment segment, where traffic must stop whenever inspection is unavailable. Which inline interface configuration satisfies all three requirements?
• A payment processor restarts the Snort process on its single FTD appliance every Sunday night and has no budget for a second device. The card-network link must stay up, and the appliance must block exploit traffic whenever inspection is available. Which inline configuration should the team choose for the interface pair?
• A payment processor must block known exploits in real time, but compliance requires that card traffic keep flowing if the inspection engine fails, and the design must leave addressing and routing on the production segment exactly as they are. Which IPS deployment design satisfies all three requirements at once?
• A payment processor is inserting one Threat Defense appliance between its cardholder application tier and the database tier. The security policy must drop known exploit traffic inline, and the business requires traffic to keep flowing if the appliance's Snort inspection process stops during maintenance. The budget funds a single chassis. Which forwarding behavior should the engineer set for the inline set?
• A retail chain must inspect traffic entering its payment environment and block exploit attempts before they reach the application servers. Its availability policy requires customer traffic to keep flowing when the Snort process is unavailable, even though inspection is briefly unavailable. Which NGIPS interface and failure policy combination meets both requirements?
• A retail chain places an FTD sensor at the data center edge so exploit traffic is blocked while it crosses the production path. Some policy deployments restart the inspection engine, and the network team requires traffic to continue forwarding during those restarts. Which NGIPS interface mode blocks exploits while allowing traffic to pass uninspected during an engine restart?
• A hospital must inspect traffic between its inpatient wireless VLAN and the EHR servers. Security requires blocking exploit attempts within the same TCP session, and the network team will tolerate a brief failover but not a sustained traffic outage if the device fails. Which NGIPS deployment mode should be selected?
• At a regional hospital, maintenance windows are unavailable for two quarters and facilities will approve only a switch mirror feed. The security team still needs months of exploit and file events from both server-to-server and internet traffic before enforcement. Which deployment mode should the engineer implement for this visibility phase?
• A state university must add its first FTD sensor to the distribution switch uplink that carries registrar traffic. A third party owns the fiber plant, so every production cable must stay exactly as it is, yet the SOC still needs full payload inspection and alerts from day one. Which NGIPS deployment mode satisfies this constraint?
• A municipal water plant must add IDS coverage to its control network before an upcoming audit. Plant rules forbid any appliance from sitting in the path of control traffic, and they ban new cabling or taps beyond a mirror session the core switch already supports. Engineers need signature-based alerts on exploit attempts this quarter, with blocking deferred to phase two. Which deployment mode meets those constraints?
• A mid-size insurer is placing one FTD appliance in front of its claims portal. The network team requires that exploit traffic be dropped before it reaches the servers, that the link keep forwarding if the inspection engine fails, and that only this single appliance be available. Which NGIPS deployment mode and failure behaviour should be used?
• A regional hospital must run NGIPS inline on its storage network links, where a sustained interruption during an appliance power failure would halt imaging transfers. While the sensor is operational, exploit attempts must be dropped as soon as they match an inspection rule. The team has budgeted fail-open bypass hardware for every link. Which Secure Firewall Threat Defense deployment design satisfies both requirements?
• You are cabling a single Secure Firewall Threat Defense appliance whose two 1 GbE data ports uplink to one Nexus switch that has LACP enabled on those ports. Both links must carry inside traffic today, cutting either cable must not interrupt the inside VLANs, and the existing access-control policy must stay untouched. Which port-channel design should you configure on the FTD interfaces?
• Two 10-GbE links run from the FTD appliance to a Catalyst switch whose ports are already configured for LACP active mode. The design calls for one logical interface, traffic balanced over both links, and a member removed from service if a cable breaks and traffic flows only one way. Which port-channel configuration on the firewall meets all three requirements?
• A branch office has two 1-Gigabit copper links from a collapsed-core switch to an FTD appliance in routed mode. The network standard requires the pair to present as one logical interface, to detect a failed or mispatched member through negotiation rather than by traffic loss, and to be built with LACP on the switch side. Which port-channel design on the FTD meets the branch standard?
• A data center team is adding a four-link 10 GbE uplink to a Secure Firewall Threat Defense appliance for a virtualization cluster. The top-of-rack switch is already set to LACP passive and cannot be changed, and member link failures must be detected quickly. Which port-channel setup on the firewall satisfies all three conditions?
• An FTD appliance connects to a campus access switch with two 10 GbE links bundled into one port channel running LACP. Before the design review, the team must state how traffic is actually spread across the member links. Which description of the EtherChannel forwarding behavior is accurate?
• A data center FTD is getting a new outside uplink: four 10 Gbps links to a top-of-rack switch that the network team already configured for LACP. The uplink must deliver up to 40 Gbps of aggregate capacity across traffic flows on a routed Layer 3 interface, with the public address and outside zone on one logical interface and no VLAN tagging. Which port channel design meets the deployment requirements?
• Two FTD appliances are being paired as an active/standby high availability set in the data center. Heartbeats and configuration synchronization must travel on a dedicated failover link, live connection and NAT state must survive a failover, and a flap on any single data interface must leave the active unit in charge. Which design and trigger behavior satisfies all three requirements?
• An FTD active/standby pair is cabled with a dedicated failover link, and the standby unit takes over promptly whenever the active unit loses power. After every switchover, established TCP sessions reset and users must reconnect. Which link carries the session data that keeps those connections alive?
• During a failover test, engineers pull the fiber that carries the state link of an active/standby FTD pair and wait for a transition. The dedicated failover link stays healthy, heartbeats continue, and the active unit never changes. Which statement about the failover link, the state link, and failover triggers explains the outcome?
• A logistics firm is pairing two identical Secure Firewall Threat Defense appliances in active and standby roles at its data center edge. Failover and state traffic must stay off the production links, established sessions must survive a switch, and the standby must take over when the active appliance dies or a monitored WAN port fails. Which active and standby failover design meets those requirements?
• A retail bank runs an FTD active/standby pair with failover heartbeats and connection-state replication sharing one 1-Gbps link between the units. During large file transfers the standby sees delayed heartbeats and declares the primary unreachable even though it is still passing traffic. Which change to the failover link design keeps the pair's health checks accurate?
• A hospital is pairing two Threat Defense appliances in active/standby mode for its network core. The design must keep established TCP and UDP sessions alive through a failover, force a unit switch when the outside uplink fails, and keep heartbeat traffic separate from the replicated session state. Which failover link and trigger design meets all three requirements?
• A branch runs Threat Defense in routed mode with two equal-cost static routes through different ISP gateways. Last month the second gateway stopped responding while the local interface stayed up, and the firewall kept sending half the flows into a black hole. Which change keeps traffic on the working paths while both ISP circuits stay in service?
• A branch office's routed-mode Secure Firewall Threat Defense has two WAN interfaces, each connected to a different ISP, and the engineer wants one default route per interface with the same metric so traffic spreads across both paths. The inside user network sits on a VLAN interface that must stay untouched. Which ECMP configuration makes the two default routes load-balance?
• A retail chain connects its next-generation firewall to two ISPs of equal bandwidth and wants outbound sessions to share both links during normal operation. The design must use equal-cost next hops only, keep every TCP session on a single path, and avoid policy-based routing. Which ECMP routing design on Threat Defense satisfies these constraints?
• A branch runs an FTD in routed mode with two ISP uplinks on separate outside interfaces, and the team wants outbound flows spread across both paths using static routes configured in the FMC. The inside interface must keep relaying DHCP for the user VLAN. Which ECMP setup meets these requirements?
• A branch runs FTD in routed mode between the LAN and two ISP uplinks that reach the same remote prefixes. The network team wants outbound flows load-balanced across both links during normal operation, and every session must still be matched and inspected by the state that saw the first packet. Which ECMP approach meets both requirements?
• A broadcaster's FTD has two equal-capacity uplinks, one to each of two routers that both advertise the default route. Today the team gives the second route a higher metric so it stays a warm backup, and they want outbound flows to use both links while each conversation stays on one path. Which routing design gives them equal-cost multipath forwarding?
• A branch office runs an FTD whose default route points at ISP-A, with a floating backup route through ISP-B. The ISP-A first hop keeps answering while traffic beyond it black-holes, so the box keeps sending users into a dead path. The team wants failover driven by reachability of a stable target on the far side rather than by interface state. Which route-tracking design should be configured on the primary default route?
• A branch FTD has two ISP uplinks, and the primary interface stays up when the provider's peering path fails, so the default route stays in the routing table. The architect still wants both ISP routes kept as static routes in the FMC and needs traffic to shift to the backup ISP when a probe beyond the local gateway stops replying. Which control should be bound to the primary static route to make that failover happen?
• A branch office gets a primary broadband circuit plus a backup LTE link, but the ISP offers no BGP session and hands over a single routed interface. Engineers need Secure Firewall Threat Defense to drop the primary default route on its own as soon as the ISP next hop stops answering, without an operator. Which high availability design should they use for static route tracking at this site?
• A retail branch runs a single Secure Firewall Threat Defense appliance with two static default routes, one per ISP handoff, because both providers supply static routes only. When one ISP fails, its router stays powered and the handoff interface stays up, so traffic blackholes until an operator intervenes. Which route-tracking design should move branch traffic onto the surviving ISP?
• A clinic runs routed-mode Secure Firewall Threat Defense (FTD) with two ISP uplinks. The primary uplink keeps its static default route even when the ISP's first hop stops answering, so traffic blackholes until an operator shuts the interface. The backup static route must stay ready but unused while the primary path is healthy. Which static route tracking design with an SLA monitor should the engineer configure for link failover?
• A branch office runs an FTD appliance with two static default routes, the primary pointing to ISP one and a backup to ISP two at a higher metric. The ISP hands addressing down statically with no routing protocol peering. Last night the ISP one gateway stopped answering while the FTD interface stayed up, so traffic blackholed for ten minutes. Which routing change makes the primary route withdraw when its gateway goes silent?
• A bank is clustering eight identical Secure Firewall Threat Defense appliances to raise data center throughput. The design must deliver four things: higher aggregate throughput, one single Management Center view, session state that survives losing the leadership unit, and cluster chatter kept off the production interfaces. Which role and cluster control link arrangement meets all four requirements?
• A retailer plans to group four appliances at the distribution center into a cluster so aggregate throughput grows beyond a single box while the site stays online if one appliance dies. The network team needs the roles, configuration handling, and the intra-cluster wiring documented before cabling begins. Which statement about cluster roles, configuration, and the cluster control link is correct for this design?
• A regional streaming company is consolidating two data center edge sites into one security platform. Traffic must be distributed across appliances that all forward traffic simultaneously, aggregate throughput must grow as units are added, one appliance must own cluster health and configuration, and state must stay synchronized across units. Which high availability and scaling design meets the throughput, role, and state requirements?
• A retail chain places four Secure Firewall Threat Defense nodes in a cluster behind a load balancer to absorb peak traffic. Which member coordinates cluster-wide control-plane functions while all members forward production traffic?
• A security engineer is designing a Secure Firewall Threat Defense cluster for a data center that must scale past a pair of appliances. One node has to coordinate cluster health monitoring and the policy updates arriving from Secure Firewall Management Center, while every node still forwards production traffic and a dedicated cluster control link joins the nodes together. Which part of this cluster design performs those coordination duties while traffic keeps flowing?
• A colleague is mapping out Threat Defense clustering for a refresh project and asks how the roles divide the work. Which statement correctly describes the control unit, the data units, and the cluster control link in a healthy cluster?
• A regional insurance office runs a single Threat Defense appliance and needs the branch to survive a hardware failure automatically with only one extra identical appliance available. The design must stay stateful and simple to manage from the Management Center. Which high availability design fits the office best?
• A healthcare provider's internet edge runs a single FTD appliance that saturates during open enrollment. The design must push peak throughput past one appliance, keep one policy set under a single management center, and keep the edge serving if one appliance fails. Which high availability design meets all three requirements?
• A content provider's central data center sees sustained traffic peaks above one appliance's throughput, and a single node failure must leave supported established sessions running. The team also requires that inter-node state traffic stays off the production links. Which high availability design meets the throughput, session continuity and dedicated state-link requirements?
• A retail bank has budget for exactly two firewall appliances, one installed in each of its two buildings and joined by a dedicated Layer 2 link sized for failover and state traffic but far below the throughput a cluster control link would need. Peak traffic fits comfortably inside one appliance, the pair must fail over automatically with established sessions preserved, and only these two units are approved hardware. Which high availability option best fits this two-unit site?
• A data center expects traffic growth beyond what one appliance can pass, and supported established sessions must survive a hardware failure while the whole platform is managed as one system. Which device availability design meets all of those requirements?
• A regional office has two Secure Firewall Threat Defense appliances in one rack. Peak traffic stays well within a single appliance, the budget allows only those two units, and existing sessions must survive a hardware failure while one unit handles production traffic at a time. Which high availability design meets the capacity and session requirements?
• A retail company deploys an FTDv instance in an AWS VPC to route and NAT traffic between a public subnet and a private subnet. Routes, an Elastic IP on the outside interface, and security-group rules are in place. The appliance's own HTTPS page opens, while every session that tries to transit through it times out. Which AWS instance setting should the team change so the appliance can forward traffic for other hosts?
• A regional bank is deploying its first Secure Firewall Threat Defense Virtual on the on-premises VMware cluster and a second instance in Azure for a branch workload. Both must be configured and monitored from one console with identical policy objects. Which management arrangement lets the team run one policy across both virtual appliances?
• A retailer is standing up its first two virtual Secure Firewall Threat Defense appliances: one on an on-premises ESXi cluster and one in an Azure VNet. Both must be administered from the existing on-premises Secure Firewall Management Center with a single access control policy, and the Azure network security group must allow management traffic from the FMC. Which virtual appliance management design satisfies all three requirements?
• A hospital group's existing Management Center already governs its physical firewalls, and the team must add a Secure Firewall Threat Defense virtual appliance in AWS for a new outpatient portal. The cloud management interface must stay off the public internet, and policy must remain in the existing FMC. Which virtual deployment and registration design meets both requirements?
• A retailer is moving checkout workloads into AWS while keeping a private data center on VMware. Security mandates a single Secure Firewall Management Center (FMC) console, inspection inside each environment, and management traffic carried on private connectivity. Which deployment model satisfies all three requirements?
• A retailer runs four virtual Secure Firewall Threat Defense appliances on its on-premises ESXi cluster and three FTD instances launched from the AWS marketplace. Compliance requires the management console itself to run on premises inside the corporate network, and the team wants one console with shared objects. Which management deployment satisfies both requirements?
• A bank is retiring the appliance its team still calls the Firepower Management Center, the product's earlier name, and has deployed a virtual Secure Firewall Management Center in its own data center. The new appliance has its address, DNS, and a Smart Licensing token, and it can reach all twelve device manager interfaces. The old manager still owns every device and its policies. What sequence should the team follow to register the devices with the new virtual Management Center?
• A retailer is standing up its first SOC. Compliance requires the management plane to stay in its own data center as a virtual machine on the existing cluster, and the design must use one management console for every device. The fleet is 24 branch FTD appliances plus six FTDv instances in AWS that already reach the data center over an IPsec tunnel. How should the AWS firewalls be registered with the on-premises virtual Management Center?
• A virtual Secure Firewall Management Center (FMC) is deployed on a vSphere host, and a Threat Defense Virtual appliance in the same cluster must be brought under its control. Its image offers only a command line, the appliance must originate its own management connection, and first trust must use a registration key configured in FMC. Which statement correctly describes that first registration?
• A regional hospital is standing up its first virtual Management Center to manage four FTD virtual appliances in its private cloud and two physical FTD appliances in clinics that use carrier-assigned addresses for the contract year. The vFMC cannot open sessions to the clinics, but the clinic appliances can reach the vFMC. The clinics cannot be readdressed or given inbound reachability during the contract year. Which registration approach lets all six devices join this single Management Center?
• A security team has just deployed a virtual Secure Firewall Management Center on a vSphere cluster and is onboarding appliances that were previously managed by a retired Management Center. One FTD appliance still reports the decommissioned manager, so the Add Device request fails. Which registration step must happen on the device CLI before the appliance can join the new Management Center?
• A security team deploys the Secure Firewall Management Center as a virtual appliance on an ESXi host at headquarters and must onboard a branch FTD that has never had a manager configured. Console access to the FTD is available, both management interfaces can communicate over the required management ports, and the team holds FMC admin rights. Which registration procedure binds the branch FTD to the virtual Management Center?
• A retailer runs FTD Virtual instances in AWS and Azure, and its infrastructure is entirely in the public cloud. The team wants one console for policy and objects, prefers that Cisco hosts and patches the manager, and plans to onboard a supported release. Which cloud management option fits these requirements?
• A startup with no data center or office servers runs FTD virtual appliances in AWS and Azure and wants one place to build policy for both clouds. Every appliance can open a management session to an address in AWS, and the budget covers one management instance. Which cloud management option gives them that single policy source?
• A retailer runs FTD virtual instances in a cloud VPC alongside its on-premises firewalls. The instances have only outbound connectivity, the existing site-to-site VPN already carries traffic to the data center where the Management Center lives, and the team wants one place to build and deploy policies for both environments. Where should the cloud instances be registered to keep one console and stay on the existing VPN?
• A SaaS company runs FTD virtual instances in two AWS regions and wants one place to build and push policy. Management interfaces must sit in a separate VPC that only the security team's jump hosts can reach, and management traffic must stay clear of the congested site-to-cloud link. Which management placement for these virtual appliances meets all three requirements?
• A retail company runs ten supported Secure Firewall Threat Defense virtual appliances across AWS VPCs and its on-premises hypervisors. Operations has no capacity to deploy or patch another management virtual machine, and administrators need a single console that applies consistent policy everywhere. Which management option best fits these ten virtual appliances?
• A retailer has eight Threat Defense virtual appliances spread across two accounts on the same cloud provider and needs one place to build and push policy to all of them. Corporate requires that every management session travel only inside the cloud network and never ride the link to headquarters. Which virtual appliance management design keeps policy in one place while meeting that requirement?