1.6 Cisco NGFW Features CCIE-SECURITY Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company uses a mix of Windows Active Directory and Linux LDAP servers for authentication. The security team wants to enforce user-based policies on the NGFW for both environments. What is the best way to integrate user identity?

   • AUse only Active Directory and ignore LDAP, since most users are in AD.
   • BCreate static user accounts on the NGFW for all users.
   • CConfigure the NGFW to poll both Active Directory and LDAP servers for user and group information.
   • DUse RADIUS for all authentication and map users to groups via RADIUS attributes.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A network administrator notices that a new application is not being correctly identified by the NGFW's AVC engine. The application uses dynamic ports and encrypted traffic. What is the most likely reason for the misidentification?

   • AThe NGFW's AVC license has expired.
   • BThe application is using a protocol that AVC does not support.
   • CThe AVC engine relies on port-based signatures, which are ineffective for dynamic port applications.
   • DThe AVC engine is not configured to perform deep packet inspection.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company wants to block traffic from a specific country, but some of its legitimate partners are located in that country and use IP addresses that are not in the geolocation database as belonging to that country. What is the best way to handle this?

   • ADo not use geolocation; instead, block based on IP reputation.
   • BCreate a geolocation-based policy to block the country, and then add an allow policy for the specific partner IPs.
   • CUse a custom geolocation database that includes the partner IPs as being from a different country.
   • DBlock the entire country and ask partners to use a VPN.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A hospital network must inspect all HTTPS traffic to detect malware, but the security team is concerned about breaking access to a third-party lab portal that uses certificate pinning. The firewall is currently configured to decrypt all SSL traffic with a single internal CA. Users report that the lab portal fails to load. What should you do to restore access while still inspecting other HTTPS traffic?

   • ADisable SSL decryption globally and rely on URL filtering to block malicious sites.
   • BCreate an SSL decryption rule that bypasses decryption for the lab portal's domain and apply it before the general decrypt rule.
   • CAdd the lab portal's certificate to the firewall's trusted CA list and keep the decrypt rule unchanged.
   • DConfigure the firewall to use passive inspection for the lab portal domain.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A global company has a firewall that blocks traffic from certain countries. They notice that legitimate customers from a blocked country are being denied service. The company wants to allow these customers while still blocking malicious traffic from that country. What is the best way to achieve this?

   • AUse AVC to identify the customer's application and allow it.
   • BRemove the geolocation block for that country entirely.
   • CChange the geolocation database to mark the customer's IP as from a different country.
   • DCreate an allow rule for the specific customer's IP addresses and place it before the geolocation block rule.
   Reveal Solution Discussion Select an answer first