A Cisco Secure Firewall (FTD) must be inserted between a server subnet and its default gateway router. The servers' IP addresses, subnet and default gateway cannot change. Which firewall mode meets the requirement?
Select an answer to reveal the explanation.
Short Explanation
A transparent firewall is like a turnstile dropped into an existing hallway: nobody gets a new address, they just walk through the check. Routed mode would make the firewall a new hop that you'd have to re-point every host at. And watch out for passive and tap modes, which watch but can't enforce.
Full Explanation
Cisco Secure Firewall supports routed and transparent firewall modes. In routed mode each interface sits in a different IP subnet and the firewall is a Layer 3 hop, so inserting it in front of a server subnet requires hosts or routers to change their gateway or addressing. In transparent mode the firewall acts as a Layer 2 bridge: interfaces are grouped into a bridge group, the inside and outside segments share one IP subnet, and hosts keep their existing addresses and default gateway while traffic passes through access control and inspection. That matches a requirement for no re-addressing. Routed mode with the firewall as gateway is precisely the change the stem forbids. Passive mode receives copied traffic from SPAN and is never in the forwarding path, so it cannot enforce access control. Inline tap mode is inline physically, but it passes traffic unmodified and inspects a copy, so it does not block; it is used to evaluate policy, not to enforce it. Exam caveat: transparent mode still needs an IP address on the bridge group for management-related functions, but that address does not change the hosts' addressing. Operational check: verify the bridge group contains both interfaces, that the servers still reach their existing gateway, and that connection events show the traffic evaluated by access control.