A large enterprise has multiple FMC-managed devices and wants to centralize alerting. They want to receive email alerts for critical events from any device, but they also want to avoid duplicate alerts when the same event is seen by multiple devices. What is the best approach?

Create separate alert rules for each device and send them to different email addresses.

Configure a single alert rule on FMC that applies to all devices and use a de-duplication mechanism on the email server.

Set alert thresholds high to reduce the number of alerts, minimizing duplicates.

Configure syslog alerting to a central SIEM and have the SIEM send email alerts.

A security operations center (SOC) needs to retain logs for 18 months for compliance, but FMC storage is limited. They are considering using an external syslog server. However, they also need to be able to quickly search and analyze logs from the last 30 days. What is the most effective strategy?

Keep logs on FMC for 30 days and forward all logs to an external syslog server for long-term storage.

Use FMC's reporting feature to generate monthly reports and store them externally.

Forward logs to an external server and delete them from FMC immediately.

Keep all logs on FMC for 18 months by increasing storage capacity.

A company uses a dynamic object to block malicious IPs from an external feed. The feed updates every 5 minutes, but the access control policy only seems to use the IP list from the last deployment. What is the likely cause and solution?

The dynamic object updates automatically, but the access control policy needs to be redeployed to apply the changes.

The dynamic object is set to update manually, not automatically.

The dynamic object is not configured correctly; the feed URL is invalid.

The access control rule is not referencing the dynamic object.

A security manager needs to distribute a daily summary report to different teams based on their area of interest. The network team wants only firewall-related events, while the endpoint team wants only malware detections. What is the most efficient way to configure this in FMC?

Use the dashboard to create custom views and share them with each team.

Create two separate custom reports, each with specific filters, and schedule them to run daily with different email distributions.

Create one comprehensive report and send it to both teams.

Configure alerts to send relevant events to each team via email.

An analyst is troubleshooting a security incident and needs to correlate connection events with intrusion events. They want to see both types of events in a single view to identify the relationship. What should they use in FMC?

Use the dashboard to view both event types side by side.

Use the Analysis > Connections > Events page and enable the 'Show Intrusion Events' option.

Generate two separate reports and compare them manually.

Export both event types to a CSV file and merge them in Excel.

CCIE Security

Domain 1Objective 4

1.4 Cisco FMC Features CCIE-SECURITY Practice Questions (Page 10)

Part of the 1.0 Perimeter Security and Intrusion Prevention domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

10concepts

20%of the exam

Questions 46–50

46expert · hard
A large enterprise has multiple FMC-managed devices and wants to centralize alerting. They want to receive email alerts for critical events from any device, but they also want to avoid duplicate alerts when the same event is seen by multiple devices. What is the best approach?
Select an answer first
47expert · hard
A security operations center (SOC) needs to retain logs for 18 months for compliance, but FMC storage is limited. They are considering using an external syslog server. However, they also need to be able to quickly search and analyze logs from the last 30 days. What is the most effective strategy?
Select an answer first
48expert · hard
A company uses a dynamic object to block malicious IPs from an external feed. The feed updates every 5 minutes, but the access control policy only seems to use the IP list from the last deployment. What is the likely cause and solution?
Select an answer first
49expert · hard
A security manager needs to distribute a daily summary report to different teams based on their area of interest. The network team wants only firewall-related events, while the endpoint team wants only malware detections. What is the most efficient way to configure this in FMC?
Select an answer first
50expert · hard
An analyst is troubleshooting a security incident and needs to correlate connection events with intrusion events. They want to see both types of events in a single view to identify the relationship. What should they use in FMC?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.