1.4 Cisco FMC Features CCIE-SECURITY Practice Questions (Page 11)

Questions 51–55

1. 51expert · hard

   A security team is receiving too many alerts for medium-severity events that are often false positives. They want to reduce noise but still be notified if the number of medium-severity events exceeds a certain threshold in a short time. What should they configure?

   • ADisable alerting for medium-severity events and rely on manual log review.
   • BSet the alert threshold to 'Medium' and configure a rate-based alert to trigger only when the event count exceeds a specified number per minute.
   • CSet the alert threshold to 'High' to ignore all medium-severity events.
   • DConfigure email alerts for medium-severity events but send them to a low-priority folder.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A company needs to retain connection and security event logs for at least 12 months to meet compliance. They are using FMC with managed Firepower devices. The FMC storage is limited, so they want to offload logs to an external storage solution. What should they configure?

   • ADisable logging on the managed devices to save storage and rely on reports only.
   • BConfigure syslog forwarding from the managed devices to an external syslog server and set FMC log retention to the maximum allowed.
   • CConfigure FMC to send logs to an email address for archival.
   • DIncrease FMC disk space by adding a larger hard drive and keep all logs locally.
   Reveal Solution Discussion Select an answer first
4. 53expert · hard · select all that apply

   A company is planning to use dynamic objects in FMC to block malicious IPs from an external feed. They have several requirements. Select all that apply to correctly implement and manage this solution.

   • ADynamic objects can only be updated manually by an administrator.
   • BDynamic objects can be used in both access control rules and NAT policies.
   • CThe dynamic object must be referenced in an access control rule to take effect.
   • DThe dynamic object can be configured to pull from a URL that provides the IP list.
   • EAfter the dynamic object updates, the access control policy must be redeployed to apply changes on managed devices.
   Check answers Discussion Select an answer first
5. 54application · medium

   A security manager needs a weekly report summarizing top intrusion events and their sources. They want the report to be automatically generated and emailed to the management team every Monday morning. What should they configure in FMC?

   • AConfigure an alert rule to send the top events via email daily.
   • BUse the FMC dashboard to view the data and export it as a PDF when needed.
   • CCreate a custom report with the required data and schedule it to run weekly with email distribution.
   • DGenerate a standard report manually each week and email it to the team.
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   An organization wants to reduce alert fatigue by only notifying administrators for events that are likely to be genuine threats. They have observed that low-severity events are often false positives. What should they configure in FMC to focus on high-severity events?

   • AConfigure alerts for all severities but set a high volume threshold to reduce notifications.
   • BSet the alert threshold to 'High' so only high-severity events trigger notifications.
   • CDisable all alerting and rely on manual log review.
   • DSend all alerts to a low-priority email folder for review.
   Reveal Solution Discussion Select an answer first