A security team wants to receive immediate email notifications for critical IPS events but only wants a daily summary for high-severity events to reduce alert fatigue. They have configured the FMC to send email alerts. What should they configure to achieve this?

Configure an SNMP trap for critical events and use syslog for high-severity events.

Create two alert responses: one with severity 'Critical' and immediate email, another with severity 'High' and a scheduled email summary.

Enable the 'Email' alert action globally and set the threshold to 'High' so all events above High are emailed immediately.

Set a single email alert response to 'Critical' and rely on the default FMC daily report for high-severity events.

A compliance officer needs to receive a monthly report of all firewall rule changes and configuration changes. The report should be sent as a PDF attachment. What should the administrator do?

Create a custom report for configuration changes, schedule it monthly, and configure email delivery with PDF format.

Configure a syslog alert to send configuration changes to the compliance officer.

Generate the report on demand and manually email it each month.

Use the FMC's audit log and export it as a CSV file.

An administrator notices that the FMC is not showing any intrusion events in the Analysis menu, even though the IPS is enabled on the managed devices. What should the administrator check first?

Generate a report to see if the events are being recorded elsewhere.

Verify that the access control policy has logging enabled for intrusion events.

Restart the FMC to clear any temporary issues.

Check the FMC's disk space to ensure there is room for new events.

A company wants to automatically block traffic from countries that are not approved for business. They have a dynamic object that contains the approved country IP ranges. What is the best way to enforce this policy?

Use a static network object for the approved ranges and update it manually.

Create an access control rule that allows traffic matching the dynamic object, and rely on the default deny to block the rest.

Create a dynamic object that contains the disallowed country IP ranges and block them.

Create an access control rule that blocks traffic not matching the dynamic object, and place it before any allow rules.

A security analyst needs to produce a report that shows the top 10 source IPs generating the most intrusion events in the last 30 days. What is the most efficient way to create this report in FMC?

Use the Analysis menu to view the top IPs and take a screenshot.

Create a custom report from scratch and add a chart for top source IPs.

Use the report template 'Top Sources' and customize the time range to the last 30 days.

Manually query the event data and compile the top 10 IPs in a spreadsheet.

CCIE Security

Domain 1Objective 4

1.4 Cisco FMC Features CCIE-SECURITY Practice Questions (Page 5)

Part of the 1.0 Perimeter Security and Intrusion Prevention domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

10concepts

20%of the exam

Questions 21–25

21application · medium
A security team wants to receive immediate email notifications for critical IPS events but only wants a daily summary for high-severity events to reduce alert fatigue. They have configured the FMC to send email alerts. What should they configure to achieve this?
Select an answer first
22application · medium
A compliance officer needs to receive a monthly report of all firewall rule changes and configuration changes. The report should be sent as a PDF attachment. What should the administrator do?
Select an answer first
23application · medium
An administrator notices that the FMC is not showing any intrusion events in the Analysis menu, even though the IPS is enabled on the managed devices. What should the administrator check first?
Select an answer first
24application · medium
A company wants to automatically block traffic from countries that are not approved for business. They have a dynamic object that contains the approved country IP ranges. What is the best way to enforce this policy?
Select an answer first
25application · medium
A security analyst needs to produce a report that shows the top 10 source IPs generating the most intrusion events in the last 30 days. What is the most efficient way to create this report in FMC?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.