1.1 Deployment Modes on Cisco ASA and Cisco FTD CCIE-SECURITY Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A service provider is deploying a Firepower 9300 with multi-instance mode to host firewall instances for multiple customers. One customer requires a high-availability pair, but the provider only has one physical appliance. The provider wants to use multi-instance to create two instances on the same appliance for the customer's HA pair. Is this a valid design?

   • ANo, because HA requires two separate physical appliances
   • BYes, because multi-instance mode is designed for HA
   • CNo, because multi-instance mode does not support HA at all
   • DYes, because multi-instance mode supports HA between instances on the same appliance
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company is deploying a new ASA in routed mode to segment its corporate network from a partner network. The ASA will have two interfaces: Gi0/0 (corporate, 10.0.0.1/24) and Gi0/1 (partner, 192.168.1.1/24). The security policy requires that corporate hosts can initiate connections to the partner network, but partner hosts cannot initiate connections to the corporate network. What is the simplest way to achieve this using security levels?

   • ASet the corporate interface security level to 100 and the partner interface to 0
   • BSet the partner interface security level to 100 and corporate to 0
   • CUse a bridge group to control traffic
   • DSet both interfaces to the same security level
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A hospital is deploying an ASA in transparent mode between its existing core switch and a new medical device network. The medical devices are on the same IP subnet as the hospital's main network, and the hospital does not want to change the IP addressing. The ASA must filter traffic between the two segments. What is the primary advantage of using transparent mode in this scenario?

   • AIt avoids the need to change IP addressing on the devices
   • BIt enables NAT between the two segments
   • CIt allows the ASA to route between different subnets
   • DIt provides separate management planes for each segment
   Reveal Solution Discussion Select an answer first
5. 44application · easy

   A small office is deploying a Cisco ASA for internet access. They have a single inside interface and a single outside interface. The administrator wants to keep the configuration simple and does not need to virtualize the firewall. Which deployment mode should be used, and what is a characteristic of that mode?

   • ATransparent mode, which bridges traffic at Layer 2
   • BMulti-context mode, which provides multiple virtual firewalls
   • CMulti-instance mode, which runs multiple independent firewalls
   • DSingle context mode, which provides one security policy
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A large enterprise wants to consolidate multiple firewalls from different business units into a single ASA appliance to reduce hardware costs. Each business unit requires its own routing table, NAT policies, and access control lists, and they must not be able to see or affect each other's configurations. Which deployment mode best meets these requirements?

   • ATransparent mode
   • BMulti-context mode
   • CMulti-instance mode
   • DSingle context mode
   Reveal Solution Discussion Select an answer first