1.4 Cisco FMC Features CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard · select all that apply

   A security operations team is configuring FMC alerting to reduce noise. They want to receive alerts for critical and high severity events, but only during business hours (8 AM - 6 PM). They also want to avoid duplicate alerts for the same event. Which of the following configurations should they implement? (Select all that apply.)

   • AUse the FMC's time-based alerting feature to restrict alerts to business hours.
   • BEnable alert aggregation to group duplicate alerts within a specified time window.
   • CCreate alert responses for critical and high severity with email and SNMP destinations.
   • DSet the alert threshold to 'Critical' only to reduce volume.
   • EConfigure the alert response to send only one email per event, regardless of the number of matching rules.
   Check answers Discussion Select an answer first
2. 32application · medium

   An administrator needs to troubleshoot a recent security incident by examining connection events and intrusion events from the last 48 hours. The FMC is currently storing logs on its local disk. What should the administrator do to ensure the events are available for analysis?

   • AIncrease the log retention period to 90 days to ensure the events are still stored.
   • BVerify that logging is enabled for the relevant access control rules and that the FMC is receiving events from the managed devices.
   • CConfigure the FMC to send logs to an external syslog server for long-term storage.
   • DUse the FMC's report generation feature to create a custom report of all events from the last 48 hours.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A compliance team requires a monthly report that includes both security events and configuration changes, but the report must be archived for 7 years. The FMC's local storage is not sufficient for long-term report archiving. What is the best solution?

   • AGenerate the report on demand and save it to a network share.
   • BStore the reports on the FMC and manually download them to an external drive each month.
   • CSchedule the report to be generated and emailed to a distribution list that includes an archiving system.
   • DIncrease the FMC's storage capacity to hold 7 years of reports.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company uses a threat intelligence feed that provides a list of malicious IP addresses, updated every 15 minutes. They want their access control policy to automatically block traffic from these IPs without manual updates. What should they configure in FMC?

   • ACreate a dynamic object that pulls from the feed and use it in an access control rule to block traffic.
   • BConfigure a syslog alert to notify the administrator to update the access control list.
   • CUse a standard access control rule with a static network object that is updated via a scheduled task.
   • DManually add the IPs to a network object group and update it whenever the feed changes.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security manager needs a weekly summary of top intrusion events and blocked connections to present to executives. The report should be emailed every Monday morning. What should the administrator configure in FMC?

   • AConfigure an alert to send the top events via email using the alerting mechanism.
   • BGenerate a report on demand and manually email it each week.
   • CCreate a custom report template with the required data, then schedule it to run weekly and email it to the manager.
   • DUse the built-in executive summary report and schedule it to run daily.
   Reveal Solution Discussion Select an answer first