1.4 Cisco FMC Features CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An organization wants to send critical alerts to both email and SNMP, but high-severity alerts only to email. What should the administrator configure?

   • AConfigure email for all alerts and SNMP for all alerts, then filter in the receiving systems.
   • BCreate two alert responses: one for critical with email and SNMP, and one for high with email only.
   • CUse syslog for critical and email for high.
   • DCreate one alert response for critical with email, and another for high with SNMP.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A large enterprise has multiple FMC-managed devices generating high volumes of logs. The FMC's local storage is filling up quickly, causing older logs to be purged before the required 90-day retention period. The administrator needs a solution that preserves logs for compliance without impacting FMC performance. What should they do?

   • AIncrease the FMC's disk space by adding a larger hard drive.
   • BReduce the logging level on the managed devices to only log critical events.
   • CEnable log compression on the FMC to store more logs in the same space.
   • DConfigure the FMC to stream logs to an external SIEM using syslog or eStreamer, and set the FMC's local retention to a shorter period.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security team uses a dynamic object that is updated by an external threat feed every 5 minutes. They have an access control rule that blocks traffic to the dynamic object. However, they notice that some traffic is still passing through for a few minutes after the feed updates. What is the likely cause and solution?

   • AThe managed devices are not receiving the updated object because they are not connected to the FMC; check device connectivity.
   • BThe dynamic object is not being used in the rule; verify that the rule references the correct object.
   • CThe access control rule is not placed early enough in the policy; move it to the top.
   • DThe dynamic object update interval is set to 5 minutes, but the FMC only checks for updates every 15 minutes; reduce the FMC's polling interval.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A manager wants to receive a daily report of all security events, but the report is too large to email as a PDF. The administrator needs to ensure the manager receives the report without exceeding email size limits. What should they do?

   • ACompress the PDF file before emailing it.
   • BSplit the report into multiple smaller reports and email them separately.
   • CReduce the report's time range to a shorter period, such as hourly.
   • DSchedule the report to be generated and stored on the FMC, and email a link to the report.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   An analyst is investigating a security incident and needs to correlate intrusion events with connection events from the same source IP. They have thousands of events and need to narrow down the search quickly. What is the most efficient approach in FMC?

   • AUse the syslog server to search for both event types.
   • BExport all events to a CSV file and use a spreadsheet to correlate them.
   • CUse the Analysis menu to open Intrusion Events, filter by the source IP, then use the 'View Connections' option to see related connection events.
   • DCreate a custom report that includes both intrusion and connection events for that IP.
   Reveal Solution Discussion Select an answer first