1.6 Cisco NGFW Features CCIE-SECURITY Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A company's firewall is configured to block social media applications using AVC. However, users are still able to access Facebook through a web browser. The AVC engine is updated. What is the most likely reason the block is not working?

   • AThe AVC rule is placed after a permit rule that allows all web traffic.
   • BThe AVC engine cannot detect Facebook because it uses HTTPS.
   • CThe firewall's AVC is disabled for the interface.
   • DUsers are accessing Facebook via a proxy that bypasses the firewall.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A security architect is designing SSL inspection for a high-throughput data center. They need to inspect all SSL traffic but are concerned about the performance impact of full decryption. They also need to ensure that traffic to a specific regulatory site is not decrypted due to legal restrictions. What is the best approach?

   • AUse full decryption for all traffic, including the regulatory site, and rely on logging restrictions.
   • BUse full decryption for all traffic except the regulatory site, which is bypassed.
   • CUse passive inspection for all traffic to avoid performance issues.
   • DUse selective decryption based on source IP, but include the regulatory site.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A company is implementing SSL inspection and wants to ensure that users cannot bypass it by using their own trusted root certificates. The firewall is configured to decrypt traffic, but users are still able to access sites with self-signed certificates. What is the best way to prevent this?

   • AAdd the user's certificates to the trusted CA list on the firewall.
   • BUse passive inspection to avoid the issue.
   • CConfigure the firewall to block traffic that uses certificates not signed by the firewall's CA.
   • DDisable SSL inspection for sites with self-signed certificates.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A company has a firewall that uses Active Directory for user identity. They want to block access to a specific application for all users except the IT department. However, the IT department's users are often logged into multiple machines simultaneously, and the firewall sometimes cannot determine the correct user. What is the best way to ensure the policy is enforced reliably?

   • AUse IP-based rules for the IT department's machines instead of user identity.
   • BConfigure the firewall to use the most recent login for user identity.
   • CUse RADIUS authentication for all users to ensure accurate identity.
   • DDisable user identity and use AVC only.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A network administrator notices that the firewall's AVC is incorrectly classifying a custom application as 'web-browsing'. This causes the application to be allowed by a rule that permits web browsing, but the company wants to block it. What is the best way to correct this?

   • ADisable AVC and use port-based rules to block the application.
   • BCreate a custom application signature for the custom application and place a block rule before the web-browsing permit rule.
   • CBlock all web-browsing traffic to prevent the custom application from being allowed.
   • DUse behavioral analysis to detect the application and block it.
   Reveal Solution Discussion Select an answer first