Management and Troubleshooting (25%)

SNCF · 75 questions

• A SOC lead at a regional bank wants one Management Center view showing only intrusion events from the card-payment VLAN across both firewalls, plus last week's top events as a PDF emailed to compliance every Monday. Which FMC setup delivers the live view and the automated report together?
• A security operations lead must send a weekly threat report to the compliance committee every Monday at 06:00, including event data filtered to match the team's Secure Firewall Threat Defense dashboard views. The report must reach an external distribution list without manual export each week. Which reporting capability in Secure Firewall Management Center should the lead configure to automate this delivery?
• A data center pair of Threat Defense devices silently drops traffic from a freshly migrated VLAN, yet a recheck of the deployed access control policy shows that subnet permitted. The engineer needs to see which firewall engine phase discards those packets, and the investigation has to stay brief enough to leave production traffic undisturbed. Which troubleshooting technique should reveal that firewall engine phase on the live appliance with minimal disruption to production?
• Your SOC at a 400-person logistics firm must reconstruct what one suspicious laptop did last Tuesday. The FMC holds connection records showing DNS queries to an unknown host and an intrusion event from the same source. The analyst needs a single time-ordered view linking those records rather than separate exports. Which view in Secure Firewall Management Center should the analyst open to correlate those events by host and time?
• A retail chain pushes an access control policy change from the Management Center to twelve devices at 02:00. At 06:00 the NOC still sees traffic matching the old rule, and the affected device shows a green status in the health monitors with no error banners anywhere. Which Management Center view confirms whether the policy push completed on that device?
• After replacing a sensor, an engineer pushes a new access control policy from the Management Center. The device shows a healthy indicator on the Health dashboard, but users report that traffic still follows the old rule. Which record in the Management Center confirms whether that policy push actually completed on the sensor?
• A security engineer reports that all policy traffic through the FTD passes and connection events are being logged, but the firewall itself cannot resolve FQDN network objects, so those objects show as unresolved in access control entries. The DNS server sits on the outside network and the firewall sends its queries from its outside interface address. Which packet capture confirms whether the DNS replies reach the firewall's control path?
• An on-call engineer at a branch office must confirm from the device itself which packets arrive on an FTD inside interface while a colleague in the data center reproduces a failed request. The engineer is already logged into the device CLI. Which CLI mode and command give the live capture?
• During a policy outage, a support engineer asks a junior administrator to collect three things straight from the appliance: the applied configuration and connection information as the device reports it, the Linux process listing for the Snort inspection processes, and the free space on the local file systems as Linux reports it. The Management Center only shows high-level health. Which device CLI workflow gathers all three items on the appliance itself?
• A security analyst must give an auditor a list of every discovered host on the claims-floor VLAN that still runs a legacy operating system before the segment is rebuilt next quarter. Threat Defense discovery has been running for six months and active scanning is off limits. Which FMC view should the analyst open?
• A bank sees large file uploads stall halfway through. The access rule permits the traffic and FMC connection events show the flow ended as blocked after inspection, but the team needs the verdict Snort returned for each individual packet. Which FTD CLI troubleshooting tool shows the per-packet Snort verdict for that flow?
• After a switch upgrade, the FMC reports the FTD as unreachable even though both devices sit on the same management VLAN and business traffic still forwards normally. That VLAN also carries backup jobs from other servers, so the capture must stay narrow. Which packet capture should you start to see whether the FTD receives and answers its own management packets?
• The SOC at a logistics firm wants one screen that every analyst opens at shift start, showing the day's blocked hosts and the latest intrusion alerts together. The compliance officer needs the same blocked-connection and intrusion figures emailed to her every Monday morning automatically. Which FMC dashboard and reporting setup satisfies both requirements?
• A credit union must manage 12 Secure Firewall Threat Defense appliances from one place: the management plane must stay inside its data center, one shared access-control policy has to reach every device, and engineers must be able to review connection and intrusion events after an incident. Which management tool fits all three requirements?
• During an outage, an engineer traces a test packet on the FTD from a client to a new reporting server. The output returns a drop reason showing that the route lookup failed for the destination, and the trace ends right there before any NAT or inspection section is printed. Which reading of the packet tracer output is correct?
• A SOC analyst at an e-commerce firm investigates one host that raised an intrusion alert, then flagged a malware download, then opened a suspicious follow-up connection within a five-minute window. Paging through separate event lists slows the timeline work down. Which FMC view puts that host's connection, intrusion, file and malware entries on one screen?
• A fintech security team must send its auditors a weekly PDF of blocked connections and intrusion alerts across twelve FTD devices, using the same event filters each time, and the file must arrive on its own. Two weeks of dashboard screenshots were rejected as evidence. Which reporting setup in Secure Firewall Management Center should the team configure?
• A security engineer traces a flow in Secure Firewall Management Center from a workstation in the Users zone to an application server in the data center zone. Each phase before policy evaluation reports success, but the trace ends there with a drop caused by a block action, while the permit rule for that server sits lower in the rule list. Which rule placement change will clear the drop at policy evaluation for this traced flow?
• After a routine upgrade, one of twelve Secure Firewall devices stops applying its access control policy while the other eleven keep working. The device still appears in the FMC device list, and the team needs to tell a registration problem from a deployment problem before touching the policy itself. Where should the engineer look first to check device health, registration, and deployment status?
• A warehouse reports that the label printer protocol on TCP 8899 from 10.20.4.11 to 10.20.9.5 sometimes fails to reach its server, and no spare switch ports can be used for mirroring. Which packet captures should the engineer run to check the data path and traffic to the FTD management interface?
• During a live incident, a junior engineer needs to see why one user's connections are dropped by the Secure Firewall Threat Defense engine on a busy production device, and the team wants the trace kept low impact. Which practice should guide how the firewall engine debug is used?
• A senior engineer has approved a short firewall engine debug run on a production Secure Firewall Threat Defense device in a busy data center to chase an intermittent policy drop. The junior engineer wants maximum verbosity for a whole night and expects a huge volume of output. Which practice makes this firewall engine debug session safe and useful?
• After an incident at a branch, a regional bank's analyst must brief the team on every host the system has discovered on that VLAN, grouped so the layout is easy to follow, with each entry opening into the host's details. The brief needs a visual overview rather than a table of log rows. Which FMC view shows the whole segment as one map?
• At a small branch, a nightly job on host 10.4.2.11 sends files to 10.4.9.20 on TCP 445 through the Threat Defense inside interface, and lately the transfer stalls with zero bytes sent. A job timeout is your only clue, so you need frame-level proof of arrival plus the exact point where processing ends. Which two troubleshooting checks confirm arrival on the wire and locate that stopping point?
• A logistics engineer sees routing failures when the FTD appliance reaches for its update server, yet the Management Center still shows the interface as up. The engineer needs to know which path the appliance itself would choose for that destination. Which device CLI command should be run, and in which mode?
• A SaaS provider's API tier drops flows intermittently even though the intrusion event log stays empty. While reproducing the problem, an engineer at the FTD CLI needs the verdict Snort applied to each individual packet, including why one packet passed and the next was dropped. Which FTD tool prints each packet's Snort verdict?
• A plant's Threat Defense appliance drops packets from a legacy SCADA polling tool, yet it raises no alerts and writes no matching connection event. The engineer needs the live Snort decision for each individual packet. Which troubleshooting tool should the engineer use to capture the per-packet verdicts?
• An engineer traces a failed sync from 10.4.18.7 to 10.9.2.41 on TCP 5432 with the FMC packet tracer. The output shows the interface and access control phases passing on an allow rule, yet the trace ends in a drop with the reason no route to host, and the device routing table holds only directly connected networks. Which change resolves the routing drop reported by the packet tracer?
• A payment processor must manage twelve FTD devices from inside its own data center, where firewall management sessions and FMC-to-device control traffic must stay in the building, and it needs shared objects, centralized events, and reports across the fleet. Which management tool should the team standardize on for this fleet?
• Users report that a new file share at 10.20.5.40 on port 445 stopped working after the firewall policy was updated. Connection events show nothing at all for these attempts, and the team wants to find which stage of processing drops the traffic before touching any rule. Which troubleshooting output should they read to locate the phase where the flow stops?
• During an incident review, a SOC analyst needs a single chronological table for one server that mixes its connection events, triggered intrusion events, and file or malware events, instead of three separate event screens. Which FMC event view should the analyst open to review those event types in one table?
• The compliance team needs evidence every Monday that last week's blocked connections for the partner network were reviewed. An analyst currently opens the default Overview dashboard, sets the time range by hand, and exports a screenshot. Which FMC reporting workflow produces that scheduled report automatically with the right filter?
• After a suspected breach, an auditor asks your SOC for one chronological listing, on a single production server, that interleaves blocked connections, intrusion alerts, file-malware hits, and Security Intelligence events across a four-hour window. The auditor wants the sequence of events rather than separate per-type summaries. Which FMC view should the analyst open to give the auditor that single sequence?
• On a production Secure Firewall Threat Defense appliance, a custom TCP application fails every few minutes while every other flow keeps working. The Management Center shows no connection event for the failing five-tuple, so the logs give you nothing. You can reach the device CLI, but the check must run right now without any configuration change. Which on-box CLI tool reveals the firewall engine's own live per-packet decision for that flow?
• A new FTD was added to the Management Center, and it appears in the device list, but the new access control policy has no effect on traffic. The administrator must confirm that the unit is registered, that the deployment actually finished, and that sensors and interfaces are healthy. Where should each of those three checks be made?
• A payment server behind Secure Firewall Threat Defense times out during business hours. The team needs to identify the access control rule for one flow without changing the running policy. Which method can show the rule match, with care taken to limit impact on a busy appliance?
• The FMC reports that a device stopped checking in after a network rewrite, and separately users cannot reach 198.51.100.20 on TCP 443 through that device. The engineer must prove whether control-channel packets from the FMC arrive and whether user traffic reaches the data port, keeping both capture files small. Which packet capture plan covers the control path and the data path with the right filters?
• A hospital security lead searches the Management Center connection events for sessions between the new application server and the database tier and finds none, even though the app team confirms the nightly jobs succeed and a packet capture on the FTD shows the sessions. The server's host profile also lists a detected operating system. Which explanation best fits the missing connection events?
• During patch planning, the team must confirm every server on the 10.30.4.0/24 segment that runs Windows Server so the right images get scheduled. Network discovery has been enabled on that interface for months and the hosts generate regular traffic. Which view in the Management Center should the engineer open to read the observed operating system for each host?
• A web app behind an FTD times out for a few users while the FMC connection event table stays empty for its server, so the engineer needs supported evidence that real packets are reaching the inspection engine on the inside interface. Which Threat Defense method shows those packets where inspection happens?
• A hospital's Threat Defense deployment drops traffic from a new imaging vendor. The connection event shows the drop disposition, but the record carries no rule name and the intrusion event list stays empty. The engineer needs Snort's own reasoning for the dropped packets. Which troubleshooting tool can record Snort's per-packet verdicts?
• A regional bank runs 22 Secure Firewall Threat Defense devices across its branches. The continuity plan requires that policies be applied and reports reviewed during a multi-day loss of internet connectivity, while the security team still wants one shared policy set instead of per-branch edits. Which device management tool best meets both requirements?
• A retailer is replacing eight branch firewalls with cloud-delivered Secure Firewall Threat Defense instances. The team needs one console to build a shared access policy for every branch, with no management VM available in the data center to stand up or patch. Which firewall management tool should the team standardize on?
• An engineer traces a flow that users say is blocked, and the FTD packet tracer returns five phases: capture allow, access-list allow, un-nat allow, route-lookup allow, then an access-list phase listing an access policy rule-id with result drop. The summary line reads Action: drop, Drop-reason: (acl-drop) Flow is denied by configured rule, and no snort phase appears. Which packet tracer phase accounts for the drop, and which component can be ruled out?
• A network team sees intermittent blocks on an internal application and needs to know, for individual packets, whether Snort allowed or dropped each one while the traffic is reproduced. The firewall is in production, so tracing must run only during a short test window, and the check has to happen on the Threat Defense device itself. Which troubleshooting command gives per-packet Snort verdicts under those constraints?
• A compliance manager who has no FMC login must receive every Monday at 07:00 a PDF of the prior week's connection events, malware alerts and access-control rule hits; the organization will retain the emailed PDF as evidence. The SOC separately wants live monitoring widgets on one shared screen. Which FMC feature delivers the manager's recurring report?
• A security engineer is assembling an asset inventory for a segmentation project and needs every internal host seen during the past week, together with its operating system, open ports, and advertised services. The list must come from the FMC rather than from a separate scanning tool. Which FMC view should the engineer use to build this host and service inventory?
• A data-center engineer sees replication traffic dropped by the FTD while packet-tracer on the same addresses returns allow, so the simulation hides the live verdict. They need the actual access control rule and drop reason applied to these production packets, and the box carries peak-hour traffic until the 02:00 change window. Which diagnostic approach should they use to observe the live rule evaluation?
• During an incident review, an analyst must show the connection, intrusion, file, and malware events tied to one internal host on a single ordered timeline for a chosen time range. The manager wants one search instead of four separate report exports. Which reporting view in Secure Firewall Management Center should the analyst use to build the combined event timeline?
• After editing the access control policy, an engineer clicks Deploy on the Management Center and leaves for the night. At handover the reviewer must prove three separate facts: the appliance is still registered to this manager, the push completed, and no health alarm fired overnight. Where should each of those three statuses be verified?
• You added a Secure Firewall Threat Defense appliance to the Secure Firewall Management Center and pushed a new access rule, but the team needs confirmation that the device is registered, that deployment finished, and that the appliance is healthy. The change window closes in ten minutes. Which Management Center pages and device checks give registration status, deployment result and device health?
• At a regional hospital, an imaging workstation at 10.44.8.21 has stopped reaching the DICOM server over TCP 443, and the Management Center shows no matching connection event. You need direct proof of what enters the Threat Defense inside data interface, scoped to that host and service so the capture file stays small enough to send to TAC. Which packet capture configuration will answer the question?
• A security engineer is following up on a risk report that flagged an internal server for repeated outbound connections to an unusual address. The engineer needs to confirm which server applications and operating system FTD has detected on that asset, rather than simply reviewing its traffic history. Which view in Secure Firewall Management Center shows the profiled attributes collected for that host?
• After a merger, an analyst must document every server in a newly discovered subnet: the operating system each host runs, the applications it serves, and the ports those services run on. Which analysis feature in the Management Center should she use for that per-host inventory?
• During a site outage a security engineer has console access to an FTD appliance, but the Management Center is unreachable over the network. They need to confirm interface status and current connections, then look at a suspect system process, using only commands that leave the running configuration untouched. Which division of work between the standard CLI and expert mode fits this diagnosis?
• Users report timeouts reaching an internal application behind a physical Secure Firewall Threat Defense appliance. The inside interface is up with the correct address, and a ping from the appliance to the server succeeds, so outbound reachability looks healthy. Starting from the device CLI, which command and mode confirm whether client packets arrive on the inside interface?
• A hospital's inline Secure Firewall Threat Defense appliance appears to drop packets on an HL7 interface. Connection events log the flow as allowed and the intrusion events table stays empty for it. The engineer needs Snort's pass-or-drop verdict for each individual packet on the wire. Which troubleshooting tool shows those per-packet verdicts?
• A SOC analyst traces a packet from 10.1.5.40 to the database server at 10.9.2.15 over TCP 443 because transactions keep timing out. The output shows the packet entering on the inside interface, a successful route lookup, translation applied by the NAT rule, and a drop whose reason names the access-list phase. How should the analyst interpret this packet tracer result?
• The SOC wants a near-real-time view of threat activity on the wall screen, while the compliance officer needs a PDF emailed on the first of each month covering a fixed window, and everything must come from the Management Center itself. Which dashboard and scheduled report design meets both needs?
• A regional bank runs forty Secure Firewall Threat Defense devices at branch sites and wants every management function delivered as a vendor hosted service rather than software it installs. It needs one console to push the same access control policy to every branch and to confirm compliance across the estate. Which management tool meets those hosting and central policy requirements?
• A SOC lead must send the CISO a recurring Friday summary of intrusion and connection events containing only the fields leadership asked for, and the CISO has no Management Center account. Delivery has to happen on its own each week with nobody exporting files by hand. Which reporting approach meets these scheduled report requirements?
• A bank runs 18 Secure Firewall Threat Defense appliances across four data centers in an air-gapped network with no internet route. The team needs shared objects, one place to correlate events, and health checks for every appliance. Which management tool should the team deploy for this on-premises estate?
• A security analyst at a retail firm must prove whether one suspicious internal host triggered only connections or also attack signatures and malicious files during the same hour. FMC already logs every event type for that segment. Which view or report should the analyst open to put that host's connection, intrusion and malware records on one timeline?
• An engineer working from a runbook written when the platform was still called Firepower must triage an FTD device that stopped receiving policy updates overnight. They need to confirm three things: whether the device is still registered, whether the last deployment job failed, and how the appliance is reporting. Which current FMC locations answer all three checks?
• Before a maintenance window, a bank's engineer must identify hosts in 10.44.8.0/24 that FMC detects as running Windows Server 2016 and verify the services and applications FMC detects for each host. FMC has monitored the segment for months. Which FMC analysis workflow should the engineer use?
• An engineer needs to confirm three things about one FTD appliance after a busy change window: whether it is still registered to the Management Center, whether the saved policy edit has been pushed to it, and whether its health checks are reporting problems. Which set of GUI locations will verify all three?
• During peak hours a payments company watches a vendor's TLS flows disappear, and FMC logs show no connection events for them. You need the exact stage where the packets are dropped, and any extra load on the production device must stay minimal. Which troubleshooting approach pinpoints that engine stage with the least added load?
• A branch's Threat Defense appliance shows a stale status in the Management Center after an overnight circuit change, while traffic through its data interfaces flows normally. Its Management Center connection is configured to use the management interface. The engineer needs recorded proof that the appliance's management traffic is still reaching the Management Center, with a filter so only that exchange appears. Which troubleshooting method provides that filtered proof of management connectivity?
• A network engineer adds a virtual Threat Defense appliance to the Management Center, but the device keeps reporting a communication error while production traffic flows normally on its outside interface. Management traffic uses the management0 interface. The engineer wants proof from the device CLI of whether the manager's exchanges reach it, limited to that conversation. Which capture approach should the engineer use?
• A data center FTD VM shows intermittent loss of reachability on its management link, and the Management Center connection keeps dropping, so GUI-driven tools are unreliable during the window. The on-call engineer needs both the current interface state and packet-level evidence captured directly on the appliance before the outage clears. Which device CLI command sequence gives the engineer interface state and live packet evidence?
• A user reports that connections from 10.14.6.30 to 10.22.9.7 on SMB fail. Packet Tracer output shows capture allowed, the access-list phase allowed the flow, route lookup resolving an egress interface, and the Snort phase reporting DROP with an intrusion rule named in its details. Which control should the engineer change first to clear the drop shown by Packet Tracer?
• A regional bank runs eight Secure Firewall Threat Defense appliances at separate branches. It needs a single management plane that holds one policy source for every device and searches and correlates events from all sites together, and the console must stay inside the bank's own data center. Which management tool delivers that single on-premises management plane?
• A tuned intrusion policy should block a specific exploit, yet sessions continue and the event views show nothing for that traffic. Engineers must see how Snort judged each packet individually, including packets that raised no event, and they must get that answer without opening a Cisco support case. Which troubleshooting tool prints the per-packet Snort verdicts?
• An FTD in a branch office stops checking in with the Secure Firewall Management Center, and the engineer has CLI access to the device. They must first confirm the device address, default route and reachability to the FMC, then read a Linux-level log file to see why registration stalled, and the diagnosis must leave every service running. Which clish and expert mode workflow supports this diagnosis?
• Users report that a file share at 10.5.20.5 stopped responding, so an engineer runs Packet Trace from 10.5.10.24 toward TCP 445. The output shows the access control evaluation matched rule 'Legacy-SMB-block' and blocked the packet, with no intrusion or file sections following. What does this output indicate about the drop reason?