2.5 Describe CIS Benchmarks for Hardening Devices Such as Cisco Secure Firewall (FTD) and Cisco IOS XE 350-701 Practice Questions (Page 6)

Questions 26–29

1. 26application · medium

   A security administrator is hardening a Cisco FTD device. The administrator wants to ensure that the management interface is not exposed to untrusted networks. Which CIS-aligned configuration should be applied?

   • ARestrict management access to specific source IP addresses using an access control policy
   • BPlace the management interface on the outside network for easier access
   • CDisable the management interface entirely and use only the console port
   • DAllow all IP addresses to access the management interface for flexibility
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A large enterprise is adopting CIS Benchmarks for its network devices. The security team has applied the Level 1 profile to all Cisco IOS XE routers. However, a compliance audit reveals that some routers are not compliant because they still have the HTTP server enabled. The team argues that the HTTP server is required for a legacy monitoring application. What is the best course of action to maintain compliance while addressing the business requirement?

   • AKeep HTTP enabled on all routers and update the compliance policy to accept the risk
   • BEnable HTTPS instead of HTTP on all routers
   • CDisable HTTP on all routers and require the monitoring application to use SSH
   • DDocument the exception, disable HTTP on all other routers, and request a waiver for the affected devices
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A Cisco IOS XE router is being prepared for deployment. The security team is applying CIS Benchmark recommendations. The router currently has several services enabled that are not required for its role as a WAN edge device. Which action should the administrator take to align with the CIS Benchmark?

   • AEnable additional services to improve functionality and then audit them quarterly
   • BDisable all unused services such as HTTP server, SNMP, and small servers
   • CDisable only the HTTP server and leave all other services running
   • DKeep services enabled but restrict them with extended ACLs
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A network team is hardening a Cisco Secure Firewall (FTD) appliance that will be deployed at a remote branch office. The team must comply with the CIS Benchmark for FTD while ensuring the device can still be managed remotely by the central NOC. Which configuration change aligns with the CIS Benchmark recommendation for the management plane?

   • AEnable the HTTP server for web-based management and restrict access by ACL
   • BDisable SSH and rely on the serial console for all remote administration
   • CEnable SSH and disable the HTTP server on the management interface
   • DEnable Telnet for management and apply a strong password policy
   Reveal Solution Discussion Select an answer first