A company wants to ensure that video conferencing traffic (e.g., Webex) gets priority over other traffic, but they also want to block file-sharing applications like BitTorrent. They have AVC enabled. What is the best way to achieve this?

Block all traffic except Webex and BitTorrent.

Create an AVC rule that rate-limits BitTorrent and a QoS policy that prioritizes Webex.

Disable AVC and use port-based QoS to prioritize Webex.

Use a single AVC rule to prioritize Webex and block BitTorrent.

A company has a mix of Windows and Linux workstations. They want to enforce user-based policies for all users, but the Linux machines are not domain-joined. Which user identity source should they use to ensure coverage for all users?

Use a combination of AD agent for Windows and LDAP for Linux.

Active Directory (AD) agent on all workstations, including Linux.

RADIUS authentication for all network access.

LDAP integration with the firewall to query user groups.

A large enterprise is deploying SSL inspection. They have a mix of internal and external users. Internal users are required to have the firewall CA installed, but external users (e.g., partners) do not. The firewall is configured to decrypt all traffic, but external users are getting certificate errors. The security team wants to inspect external traffic as well, but without causing errors. What is the best approach?

Use passive inspection for all traffic to avoid certificate errors.

Create separate SSL decryption rules: one for internal users with the CA installed, and one for external users that bypasses decryption.

Disable SSL inspection for all traffic and rely on other security measures.

Force all external users to install the firewall CA before accessing the network.

CCIE Security

Domain 1Objective 6

1.6 Cisco NGFW Features CCIE-SECURITY Practice Questions (Page 12)

Part of the 1.0 Perimeter Security and Intrusion Prevention domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

11concepts

20%of the exam

Questions 56–58

56application · medium
A company wants to ensure that video conferencing traffic (e.g., Webex) gets priority over other traffic, but they also want to block file-sharing applications like BitTorrent. They have AVC enabled. What is the best way to achieve this?
Select an answer first
57application · medium
A company has a mix of Windows and Linux workstations. They want to enforce user-based policies for all users, but the Linux machines are not domain-joined. Which user identity source should they use to ensure coverage for all users?
Select an answer first
58expert · hard
A large enterprise is deploying SSL inspection. They have a mix of internal and external users. Internal users are required to have the firewall CA installed, but external users (e.g., partners) do not. The firewall is configured to decrypt all traffic, but external users are getting certificate errors. The security team wants to inspect external traffic as well, but without causing errors. What is the best approach?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.

1.6 Cisco NGFW Features CCIE-SECURITY Practice Questions (Page 12)

Questions 56–58

A company wants to ensure that video conferencing traffic (e.g., Webex) gets priority over other traffic, but they also want to block file-sharing applications like BitTorrent. They have AVC enabled. What is the best way to achieve this?

A company has a mix of Windows and Linux workstations. They want to enforce user-based policies for all users, but the Linux machines are not domain-joined. Which user identity source should they use to ensure coverage for all users?

Keep studying — 1.0 Perimeter Security and Intrusion Prevention