A data center team must insert an FTD appliance between a legacy application server and its access switch without changing the server's IP address, its default gateway, or the subnet's existing routes. The appliance has two interfaces and must still apply access control to the server's traffic. Which FTD deployment configuration meets these Layer 2 constraints?
Select an answer to reveal the explanation.
Short Explanation
Your appliance has to act like a wire rather than a router, and you're not touching the server's config. Putting both sides in one bridge group carries the frames, while the virtual address is only for management.
Full Explanation
Transparent mode operates the appliance as a Layer 2 device, so both interfaces are enslaved to a bridge group and frames are forwarded by MAC address instead of by routing. That is exactly what preserves your constraints: the server keeps its address, keeps pointing at its original gateway, and keeps the subnet's existing routes, while access control still filters the traffic. Placing both sides in one bridge group is what creates a single broadcast domain, and the bridge group's virtual address exists only for management access to the appliance. Routed mode with addresses and a static route fails the moment you try it, because the server would have to change its gateway and the subnet would have to be re-planned. Pointing the server's gateway at the bridge group virtual address misuses that management address as a hop and still edits the server's configuration. Two separate bridge groups give you two isolated Layer 2 domains, so frames from the server never reach the switch side at all. Exam caveat: the member interfaces carry no IP addresses of their own, and each bridge group needs its own virtual address (BVI). Practical check: leave the server untouched, then confirm MAC addresses are learning on both interfaces and counters climb on each side.