A company's firewall uses geolocation to block traffic from high-risk countries. However, they are seeing false positives where legitimate users are being blocked because their ISP uses IP addresses that are registered in a different country. What is the best way to mitigate this?

Use a different geolocation database that is more accurate.

Remove the geolocation block for those countries.

Create an allow list for the legitimate users' IP addresses and place it before the geolocation block.

Use AVC to identify the legitimate users' applications and allow them.

A company wants to inspect all HTTPS traffic for data exfiltration attempts. They are concerned about the performance impact of decrypting all traffic. What is the most effective way to balance security and performance?

Use passive inspection to avoid performance impact.

Decrypt all traffic but only log metadata.

Decrypt all HTTPS traffic and use hardware acceleration for SSL processing.

Decrypt only traffic to sensitive destinations (e.g., cloud storage).

A company has a firewall that is integrated with Active Directory. They want to enforce different internet policies for different departments. However, some users are not being identified correctly because they are using VPN to connect. What is the best way to ensure user identity is accurate for VPN users?

Use RADIUS authentication for VPN users and map the RADIUS session to the user identity.

Use the VPN client's IP address to identify the user.

Use LDAP to query user groups for VPN users.

Disable user identity for VPN traffic and use IP-based policies.

A company wants to block the use of peer-to-peer file sharing applications on their network. They have enabled AVC on the firewall. What is the first step they should take to ensure the applications are blocked?

Create an AVC rule that blocks the specific peer-to-peer applications.

Update the geolocation database.

Enable SSL inspection to see the traffic.

Configure user identity to identify users.

A company wants to block access to social media for all employees except the marketing team. The firewall is integrated with Active Directory and has AVC enabled. Marketing users are in a group called 'MKTG'. What is the most efficient way to enforce this policy?

Create a rule that allows all traffic for the 'MKTG' group and blocks all other traffic.

Create a single rule that blocks social media for all users, then add an exception for the marketing team's IP addresses.

Create an AVC rule that allows social media for the 'MKTG' group and a second rule that blocks social media for all other users.

Disable AVC and use URL filtering to block social media domains for all users.

CCIE Security

Domain 1Objective 6

1.6 Cisco NGFW Features CCIE-SECURITY Practice Questions (Page 10)

Part of the 1.0 Perimeter Security and Intrusion Prevention domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

11concepts

20%of the exam

Questions 46–50

46expert · hard
A company's firewall uses geolocation to block traffic from high-risk countries. However, they are seeing false positives where legitimate users are being blocked because their ISP uses IP addresses that are registered in a different country. What is the best way to mitigate this?
Select an answer first
47application · medium
A company wants to inspect all HTTPS traffic for data exfiltration attempts. They are concerned about the performance impact of decrypting all traffic. What is the most effective way to balance security and performance?
Select an answer first
48application · medium
A company has a firewall that is integrated with Active Directory. They want to enforce different internet policies for different departments. However, some users are not being identified correctly because they are using VPN to connect. What is the best way to ensure user identity is accurate for VPN users?
Select an answer first
49application · medium
A company wants to block the use of peer-to-peer file sharing applications on their network. They have enabled AVC on the firewall. What is the first step they should take to ensure the applications are blocked?
Select an answer first
50application · medium
A company wants to block access to social media for all employees except the marketing team. The firewall is integrated with Active Directory and has AVC enabled. Marketing users are in a group called 'MKTG'. What is the most efficient way to enforce this policy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.