1.4 Cisco FMC Features CCIE-SECURITY Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security team wants to receive immediate email notifications for high-severity intrusion events but only wants a daily digest for medium-severity events. They are using FMC to manage their Firepower devices. What should they configure to meet this requirement?

   • AConfigure a single alert rule for all severities with email destination and set the threshold to high to avoid medium-severity notifications.
   • BSet the alert threshold to medium and configure the email destination to send all alerts immediately.
   • CCreate two alert rules: one for high-severity events with email destination and immediate delivery, and another for medium-severity events with email destination and a daily digest schedule.
   • DEnable syslog alerting for all events and rely on the syslog server to filter and forward emails.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An organization wants to integrate FMC alerts with their existing SIEM system. They need to send real-time security event notifications to the SIEM for correlation. What should they configure in FMC?

   • AConfigure email alerts to the SIEM administrator.
   • BUse SNMP traps to send alerts to the SIEM.
   • CGenerate a daily report and send it to the SIEM.
   • DSet up syslog alerting to forward events to the SIEM server.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A security analyst wants to ensure that all intrusion events are logged, but they are concerned about the volume of logs filling up the FMC storage quickly. What should they configure to balance logging and storage?

   • ADisable logging for low-severity events to reduce volume.
   • BEnable logging for all events but configure a shorter retention period and offload logs to an external server.
   • CLog only summary information and not full event details.
   • DIncrease FMC storage by adding more disk space.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A company wants to automatically block IP addresses that are flagged by their internal threat intelligence platform. The platform provides a REST API that returns a JSON list of IPs. What should they do in FMC to use this feed?

   • AManually copy the IP list into a static network object each time the feed updates.
   • BCreate a dynamic object with a feed type that pulls from the REST API URL.
   • CUse the FMC API to push the IP list to the access control policy.
   • DConfigure a syslog alert to notify administrators to update the blocklist.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A security team needs to provide a detailed report to management about the top 10 malware detections in the last quarter. They want the report to include charts and be generated automatically at the end of each quarter. What should they do?

   • ACreate a custom report template with the desired charts and schedule it to run quarterly.
   • BRun a standard report and email it to management at the end of each quarter.
   • CUse the dashboard to display the data and export it as a PDF manually.
   • DConfigure an alert to send the top 10 malware list via email daily.
   Reveal Solution Discussion Select an answer first