A hospital must insert an FTD between an access switch and the upstream router on a flat subnet during a ninety-minute window. Host addresses, masks and their default gateway must remain untouched, and the firewall must enforce per-host access rules on that same subnet while the management center manages it out of band. Which Secure Firewall deployment mode meets this insertion requirement?
Select an answer to reveal the explanation.
Short Explanation
With re-addressing off the table, transparent mode is the fit: it bridges at Layer 2, so you can leave host addresses, masks, and gateways unchanged. You can still enforce per-host rules and manage the firewall out of band, like adding a checkpoint without rearranging the hallway.
Full Explanation
Transparent mode with a bridge group lets the FTD sit inline at Layer 2 and enforce traffic policy without changing host addresses, masks, or default gateways. A separate management IP, reached through the out-of-band management path, lets the management center administer the device without relying on the protected subnet. Routed mode can preserve host addresses and masks, but hosts must use the FTD as their gateway for routed traffic, so it cannot meet the requirement to leave the existing gateway unchanged. Transparent mode with in-band management can provide transparent forwarding and per-host rules, but management would use the protected subnet rather than remain out of band. Transparent mode with out-of-band management and a shared subnet-wide policy meets the addressing and management constraints, but a shared policy does not enforce distinct per-host access rules. Exam caveat: transparent mode preserves hosts’ Layer 3 settings, but the firewall still needs a management address, and management is not automatically out of band. Practical check: verify the bridge-group interfaces, separate management interface and its network path, and policy matches for each required host before the maintenance window.