A data center team is adding a four-link 10 GbE uplink to a Secure Firewall Threat Defense appliance for a virtualization cluster. The top-of-rack switch is already set to LACP passive and cannot be changed, and member link failures must be detected quickly. Which port-channel setup on the firewall satisfies all three conditions?
Select an answer to reveal the explanation.
Short Explanation
Since the switch only responds, your firewall needs to start the LACP conversation by using active mode. Set fast timers to spot failed links quickly, and add all four interfaces—like using every lane in a four-lane highway.
Full Explanation
LACP active mode initiates negotiation, so the firewall can establish the aggregate with a switch that is fixed in passive mode; passive/passive peers do not initiate and therefore cannot form the channel. Fast LACP timers allow failed members to be detected more quickly, and including all four interfaces meets the required four-link uplink. The passive-firewall approach uses a valid LACP mode and includes every link, but fails because the passive switch also waits for its peer to initiate. Active LACP with default slow timers can form the channel and use all four links, but does not meet the quick-failure-detection requirement. Bundling three links while keeping the fourth as a hot spare is a familiar redundancy design, and its LACP settings are otherwise suitable, but it does not provide the specified four-member channel. Exam caveat: fast LACP timers improve protocol-level detection but do not guarantee identical end-to-end recovery times; platform behavior, timers, and downstream convergence can affect the result. Practical check: verify the firewall reports all four members as bundled and operational, confirm active/fast settings at the firewall and passive mode at the switch, then test a member-link failure and observe detection and traffic recovery.