An enterprise runs 60 Cisco Secure Firewall (FTD) devices at its sites. Today each one is configured individually, policies have drifted apart, and analysts must log in to each device to review events. Which management approach addresses this?
Select an answer to reveal the explanation.
Short Explanation
Sixty firewalls managed one at a time is sixty chances to drift. A multidevice manager lets you write the policy once, push it everywhere, and read all the events in one place. Don't fall for better note-taking around per-device management; it's still per-device.
Full Explanation
Per-device management scales poorly because every change is repeated by hand and the copies inevitably diverge. A multidevice manager, such as Secure Firewall Management Center on premises or the cloud-delivered management available through Cisco Security Cloud Control, holds shared objects and policies, assigns them to groups of devices, and deploys changes consistently. Managed devices send their connection, intrusion, file and malware events to the manager, so analysts search and correlate them in one console. That addresses both the drift and the event-review problem. Running device manager on each firewall keeps sixty separate configurations; comparing exports monthly may detect drift after the fact but does not prevent it or centralize events. A runbook of CLI commands applied by each site engineer is still manual, per-device configuration with no enforcement of consistency, and routine policy on a managed FTD is not maintained that way. Sending syslog to a file server gathers some logs, but policies are still edited device by device and a file share provides no event correlation or analysis workflow. Exam caveat: choose between on-premises and cloud-delivered multidevice management based on constraints such as data locality and operations staffing. Operational check: confirm all devices are registered to the manager, deploy a shared policy, and verify that events from several sites appear in a single search.