1.1 Deployment Modes on Cisco ASA and Cisco FTD CCIE-SECURITY Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A company is deploying an ASA in routed mode as the gateway for a new branch office. The branch has two subnets: 192.168.10.0/24 and 192.168.20.0/24. The ASA has three interfaces: Gi0/0 (outside), Gi0/1 (inside for 192.168.10.0/24), and Gi0/2 (DMZ for 192.168.20.0/24). The engineer wants to ensure that traffic from the inside can reach the DMZ and the outside, but the DMZ cannot initiate traffic to the inside. What is the correct security-level configuration?

   • ASet all interfaces to the same security level
   • BSet outside security level to 100
   • CSet DMZ security level to 100 and inside to 50
   • DSet inside security level to 100, DMZ to 50, outside to 0
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   An engineer is troubleshooting a transparent mode ASA that is not passing traffic between two VLANs. The ASA has a bridge group with Gi0/0 and Gi0/1, and a management IP of 10.10.10.2/24. The engineer notices that the ASA can ping the management IP from the network, but traffic between hosts on the two VLANs is not forwarded. What is the most likely cause?

   • AThe bridge group is not configured with a BVI interface
   • BThe management IP is not in the same subnet as the hosts
   • CThe ASA is in multi-context mode
   • DThe interfaces are not in the same bridge group
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A security architect is evaluating deployment modes for a new Cisco Firepower 9300. The requirement is to support multiple customers, each needing a separate firewall instance with its own management plane and the ability to run different software versions. However, the architect also needs to maximize the number of customers per appliance while keeping hardware costs low. Which approach should be recommended?

   • AUse multi-instance mode with a limited number of instances
   • BUse transparent mode with VLANs for each customer
   • CUse routed mode with VRFs for each customer
   • DUse multi-context mode to create many contexts on a single instance
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   An engineer is configuring an ASA in routed mode for a new site. The ASA will be the gateway for the inside network (192.168.1.0/24) and will connect to the internet via a service provider. The engineer has assigned IP addresses to the interfaces and configured a default route to the provider. However, inside hosts cannot reach the internet. The engineer verifies that the ASA can ping the provider's gateway, but inside hosts cannot. What is the most likely missing configuration?

   • ANAT is not configured for inside traffic
   • BThe default route is pointing to the wrong interface
   • CThe inside interface is not in a bridge group
   • DThe ASA is in multi-context mode
   Reveal Solution Discussion Select an answer first
6. 40expert · hard · select all that apply

   A network administrator is planning to migrate an existing ASA from single context mode to multi-context mode. The administrator needs to ensure that the migration is successful and that existing configurations are preserved. Which of the following are required steps or considerations for this migration? (Select all that apply.)

   • AEnsure that the ASA has enough memory and resources for multiple contexts
   • BConvert the running configuration to a context configuration file
   • CChange the firewall mode to transparent
   • DDisable all interfaces before migration
   • EBack up the current configuration before migration
   Check answers Discussion Select an answer first