Which two dynamic routing protocols are supported in Firepower Threat Defense without using
FlexConfig? (Choose two.)
BE
Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/660/fdm/fptd-fdm-config-guide-660/fptd-fdm-routing.html
Which policy rule is included in the deployment of a local DMZ during the initial deployment of a
Cisco NGFW through the Cisco FMC GUI?
C
What are two application layer preprocessors? (Choose two.)
BC
Explanation:
Reference:
https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Application_Layer_Preprocessors.html
An engineer is tasked with deploying an internal perimeter firewall that will support multiple DMZs
Each DMZ has a unique private IP subnet range. How is this requirement satisfied?
C
Explanation:
Reference:
https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/general/asa-96-general-config/intro-fw.html
An engineer must configure high availability for the Cisco Firepower devices. The current network
topology does not allow for two devices to pass traffic concurrently. How must the devices be
implemented in this environment?
C
When deploying a Cisco ASA Firepower module, an organization wants to evaluate the contents of
the traffic without affecting the network. It is currently configured to have more than one instance of
the same device on the physical appliance Which deployment mode meets the needs of the
organization?
A
Explanation:
https://www.cisco.com/c/en/us/td/docs/security/asa/asa910/configuration/firewall/asa-910-firewall-config/access-sfr.html
Inline tap monitor-only mode (ASA inline)—In an inline tap monitor-only deployment, a copy of the
traffic is sent to the ASA FirePOWER module, but it is not returned to the ASA. Inline tap mode lets
you see what the ASA FirePOWER module would have done to traffic, and lets you evaluate the
content of the traffic, without impacting the network. However, in this mode, the ASA does apply its
policies to the traffic, so traffic can be dropped due to access rules, TCP normalization, and so forth.
An organization has a Cisco FTD that uses bridge groups to pass traffic from the inside interfaces to
the outside interfaces. They are unable to gather information about neighbouring Cisco devices or
use multicast in their environment. What must be done to resolve this issue?
C
Explanation:
"In routed firewall mode, broadcast and multicast traffic is blocked even if you allow it in an access
rule..." "The bridge group does not pass CDP packets packets..."
https://www.cisco.com/c/en/us/td/docs/security/asa/asa913/configuration/general/asa-913-general-config/intro-fw.html
Passing Traffic Not Allowed in Routed Mode
In routed mode, some types of traffic cannot pass through the ASA even if you allow it in an access
rule. The bridge group, however, can allow almost any traffic through using either an access rule (for
IP traffic) or an EtherType rule (for non-IP traffic):
IP traffic—In routed firewall mode, broadcast and "multicast traffic is blocked even if you allow it in
an access rule," including unsupported dynamic routing protocols and DHCP (unless you configure
DHCP relay). Within a bridge group, you can allow this traffic with an access rule (using an extended
ACL).
Non-IP traffic—AppleTalk, IPX, BPDUs, and MPLS, for example, can be configured to go through using
an EtherType rule.
Note
"The bridge group does not pass CDP packets packets, or any packets that do not have a valid
EtherType greater than or equal to 0x600. An exception is made for BPDUs and IS-IS, which are
supported. "
A network engineer implements a new Cisco Firepower device on the network to take advantage of
its intrusion detection functionality. There is a requirement to analyze the traffic going across the
device, alert on any malicious traffic, and appear as a bump in the wire How should this be
implemented?
D
Explanation:
Traditionally, a firewall is a routed hop and acts as a default gateway for hosts that connect to one of
its screened subnets. A transparent firewall, on the other hand, is a Layer 2 firewall that acts like a
“bump in the wire,” or a “stealth firewall,” and is not seen as a router hop to connected devices.
However, like any other firewall, access control between interfaces is controlled, and all of the usual
firewall checks are in place. Layer 2 connectivity is achieved by using a "bridge group" where you
group together the inside and outside interfaces for a network, and the ASA uses bridging techniques
to pass traffic between the interfaces. Each bridge group includes a Bridge Virtual Interface (BVI) to
which you assign an IP address on the network. You can have multiple bridge groups for multiple
networks. In transparent mode, these bridge groups cannot communicate with each other.
https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/general/asa-97-general-config/intro-fw.html
Which two conditions must be met to enable high availability between two Cisco FTD devices?
(Choose two.)
BE
Explanation:
https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/212699-configure-ftd-high-availability-on-firep.html
Conditions
In order to create an HA between 2 FTD devices, these conditions must be met:
Same model
Same version (this applies to FXOS and to FTD - (major (first number), minor (second number), and
maintenance (third number) must be equal))
Same number of interfaces
Same type of interfaces
Both devices as part of same group/domain in FMC
Have identical Network Time Protocol (NTP) configuration
Be fully deployed on the FMC without uncommitted changes
Be in the same firewall mode: routed or transparent.
Note that this must be checked on both FTD devices and FMC GUI since there have been cases where
the FTDs had the same mode, but FMC does not reflect this.
Does not have DHCP/Point-to-Point Protocol over Ethernet (PPPoE) configured in any of the interface
Different hostname (Fully Qualified Domain Name (FQDN)) for both chassis. In order to check the
chassis hostname navigate to FTD CLI and run this command
An engineer is building a new access control policy using Cisco FMC. The policy must inspect a
unique IPS policy as well as log rule matching. Which action must be taken to meet these
requirements?
C