1.4 Cisco FMC Features CCIE-SECURITY Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   An organization is required to retain security logs for at least one year for compliance. The FMC's local storage is limited and cannot hold that much data. What should the administrator do to meet the retention requirement?

   • AIncrease the FMC's log retention period to 365 days, assuming the disk has enough space.
   • BReduce the logging level to only store critical events, so they take up less space.
   • CGenerate weekly reports and store them as PDFs to serve as the log archive.
   • DConfigure the FMC to send logs to an external syslog server or SIEM that can store logs for a year.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An analyst is investigating a possible breach and needs to find all connection events from a specific source IP that occurred in the last hour, but only those that were denied by the access control policy. What is the most efficient way to do this in FMC?

   • AUse the Analysis > Connections > Events page, apply a filter for the source IP and action 'Block', and set the time range to the last hour.
   • BGenerate a custom report with the source IP and action 'Block' and run it for the last hour.
   • CCreate an alert rule that triggers on denied connections from that IP and wait for the alert.
   • DCheck the syslog server for all events from that IP and manually filter for 'Block'.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A network operations center (NOC) uses a centralized syslog server for all security events. They also want to receive SNMP traps for critical events on their network management system. What should the administrator configure in FMC?

   • AConfigure email alerts for all events and rely on the NOC to check email.
   • BConfigure the FMC to send all events to the syslog server and also send all events as SNMP traps.
   • CConfigure SNMP as the logging destination for all events and use email for critical alerts.
   • DConfigure syslog as the logging destination for all events and create an SNMP alert response for critical events.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company uses a dynamic object that contains IP addresses of known bad actors. They want to be alerted when the object is updated so they can verify the change. What should they configure?

   • AUse the access control policy's logging to see when traffic matches the object.
   • BCreate an alert that triggers when the dynamic object is modified, using the FMC's audit log or system event alerting.
   • CCheck the dynamic object's last updated timestamp manually each day.
   • DConfigure a report to show the object's contents daily.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An organization wants to reduce the number of alert emails sent to the security team. They only want to be notified for events that are both high severity and have a risk score above 80. What should they configure in FMC?

   • AConfigure email alerts for all events and then filter them in the email client.
   • BCreate an alert response with a severity filter of 'High' and a risk score threshold of 80.
   • CSet the global alert threshold to 'High' and rely on the default risk score.
   • DCreate two alert responses: one for high severity and one for risk score above 80.
   Reveal Solution Discussion Select an answer first