Two Cisco Secure Firewall devices protect a data-center edge. The requirement is that established connections continue if the active device fails. A single device has enough throughput for the load. Which deployment meets the requirement?
Select an answer to reveal the explanation.
Short Explanation
Think of a co-pilot who has been watching every gauge the whole flight: if the captain passes out, the plane keeps going without a hiccup. That's stateful failover, with the state link as the co-pilot's eyes. If you build redundancy without shared state, the backup is there but every conversation drops.
Full Explanation
Secure Firewall high availability pairs two identical devices as active and standby. The active unit passes traffic while the failover link carries health and configuration information, and the stateful failover link replicates connection state, NAT translations and related tables to the standby. When the active unit fails, the standby takes over the same addresses with existing connections already in its tables, so established sessions continue. Because one device can carry the load, clustering for added throughput is unnecessary; high availability is the fit. Two standalone devices behind a load balancer each build an independent connection table, so sessions on a failed device are lost and asymmetric flows may be dropped. Failover without a state link still moves addresses to the standby, but the standby has no record of existing connections, so users must reconnect, which fails the stated requirement. Using HSRP with synchronized policy provides a shared gateway address on routers, but Secure Firewall does not use HSRP for its own redundancy and nothing in that design copies connection state between the devices. Exam caveat: clustering also preserves flows, but it is chosen to scale throughput beyond one unit; the stem's sizing removes that need. Operational check: confirm the pair shows one active and one standby unit, then test a manual switchover while a long-lived session stays up.