1.6 Cisco NGFW Features CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company wants to enforce a policy that blocks access to social media applications for all users in the 'Marketing' group, but allows access for the 'Executives' group. The NGFW is integrated with Active Directory. What is the most efficient way to implement this policy?

   • ACreate two separate security policies: one blocking social media for the Marketing group and another allowing it for Executives, placing the more specific policy first.
   • BUse a global URL filtering policy to block social media for everyone, and then manually allow Executives by IP address.
   • CCreate a single policy that blocks social media for all users, and then add an exception for Executives using a separate rule.
   • DConfigure the NGFW to use RADIUS for user identity instead of Active Directory, because RADIUS is more reliable.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A multinational company wants to block all traffic from countries where it has no business operations, except for a few specific partner IP addresses in those countries. The NGFW uses the geolocation database. What is the best way to implement this?

   • ACreate a single policy that allows traffic from all countries except the unwanted ones, using a negative condition.
   • BDisable geolocation-based policies and use IP reputation lists instead.
   • CUse the geolocation database to manually add the partner IPs to the allowed list, and then block all other traffic from those countries.
   • DCreate a policy that blocks traffic from the unwanted countries, and place a higher-priority policy that allows the specific partner IPs before the block rule.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An organization wants to ensure that video streaming applications do not consume excessive bandwidth during business hours, but they should still be accessible. The NGFW supports AVC. What should the administrator configure?

   • ABlock video streaming applications entirely during business hours.
   • BCreate a security policy that allows video streaming but does not apply any rate-limiting.
   • CCreate an AVC policy that rate-limits video streaming applications to a specific bandwidth during business hours.
   • DUse QoS policies on the router instead of AVC on the NGFW.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security administrator needs to inspect SSL traffic to detect data exfiltration, but the organization's privacy policy prohibits decrypting traffic for employees' personal webmail. What is the best approach?

   • ADecrypt all traffic and then re-encrypt it, but do not log the content of webmail traffic.
   • BConfigure SSL decryption for all traffic except webmail domains, using a decryption policy that excludes those domains.
   • CUse passive SSL inspection to analyze the metadata of all SSL traffic without decryption.
   • DDisable SSL inspection entirely to avoid privacy issues.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company is implementing SSL inspection and wants to ensure that internal clients do not see certificate warnings when accessing internal applications. The NGFW will generate a certificate for each internal site. What should the administrator do?

   • AUse a publicly trusted certificate for each internal application and configure the NGFW to forward it without re-signing.
   • BInstall the NGFW's CA certificate on all internal clients' trusted root store.
   • CDisable SSL inspection for internal applications to avoid certificate warnings.
   • DConfigure the NGFW to use a self-signed certificate for each internal site.
   Reveal Solution Discussion Select an answer first