1.4 Cisco FMC Features CCIE-SECURITY Practice Questions (Page 12)

Questions 56–59

1. 56application · medium

   A company's FMC is running out of disk space because it stores all connection and security events locally. They want to keep recent events for quick analysis but archive older events to meet compliance. What is the most efficient approach?

   • AIncrease FMC disk space by adding more storage to the appliance.
   • BDisable logging for non-critical events to reduce storage usage.
   • CExport logs manually to a network share on a weekly basis and delete them from FMC.
   • DConfigure FMC to forward all events to an external syslog server and set local retention to a shorter period.
   Reveal Solution Discussion Select an answer first
2. 57application · medium

   A network team wants to block traffic from a set of IP addresses that are updated dynamically based on the current threat landscape. They have configured a dynamic object in FMC. What must they do to ensure the access control policy uses the latest IP list?

   • AReference the dynamic object in an access control rule and ensure the rule is enabled.
   • BManually update the object's IP list before each policy deployment.
   • CConfigure an alert to notify administrators when the object changes.
   • DCreate a static network object with the same IPs and use it in the rule.
   Reveal Solution Discussion Select an answer first
4. 58application · medium

   An analyst needs to investigate a specific security event that occurred yesterday. They want to view all connection events from a particular source IP to a specific destination port. What should they use in FMC?

   • AGenerate a report of all events and manually search through it.
   • BCheck the syslog server logs for the event.
   • CUse the dashboard to see a summary of events.
   • DUse the Analysis > Connections > Events page and apply filters for source IP and destination port.
   Reveal Solution Discussion Select an answer first
5. 59application · medium

   A compliance officer requires a monthly report of all firewall rule changes. The report should be automatically generated and sent to the compliance team via email. What is the best way to accomplish this in FMC?

   • ACreate a custom report for rule changes and schedule it to run monthly with email distribution.
   • BConfigure an SNMP trap to notify the compliance team of rule changes.
   • CUse the FMC dashboard to display rule changes and take a screenshot.
   • DManually export the audit log and email it to the compliance team each month.
   Reveal Solution Discussion Select an answer first