1.2 Firewall Features on Cisco ASA and FTD CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An organization is deploying FTD and wants to use traffic zones to simplify policy management. They have multiple interfaces for different departments (HR, Finance, Engineering) and want to apply the same security policy to all of them. Which approach is most efficient?

   • ACreate a separate zone for each department and apply identical policies to each zone.
   • BCreate a zone named 'Internal' and assign all department interfaces to it, then apply policies to that zone.
   • CUse a global policy that applies to all interfaces without zones.
   • DAssign all interfaces to the same security level and use access-lists.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   An engineer is configuring PBR on an FTD to send VoIP traffic from a specific subnet to a WAN optimizer. The route map is configured to match the source subnet and set the next hop to the WAN optimizer. However, the engineer notices that the VoIP traffic is not being redirected. The engineer has verified that the route map is correct and applied to the ingress interface. What else should be checked?

   • AConfirm that the route map is using a standard ACL instead of an extended ACL.
   • BVerify that the VoIP traffic is not being NATed before PBR.
   • CEnsure that the WAN optimizer is reachable from the FTD and that the next-hop IP is correct.
   • DCheck that the route map is applied to the egress interface.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company wants to redirect all traffic from the DMZ to a FirePOWER module for advanced threat inspection. The FirePOWER module is connected to a separate interface on the ASA. Which redirection method is most appropriate?

   • AConfigure a service policy with the 'inspect' command to send traffic to the FirePOWER module.
   • BUse a static route to send all traffic from the DMZ to the FirePOWER module.
   • CPolicy-based redirection (PBR) that matches DMZ traffic and sets the next hop to the FirePOWER module.
   • DInterface-based redirection by configuring the DMZ interface to send all traffic to the FirePOWER module.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   An organization is implementing identity firewall on their ASA. They have integrated with Active Directory and are using user-based policies. However, they notice that some users are being denied access even though they are members of the allowed group. The administrator suspects that the user-to-IP mapping is not being updated correctly. What is the most likely cause?

   • AThe Active Directory server is not reachable from the ASA.
   • BThe access control rule is using the user's IP address instead of the group name.
   • CThe user is using a different device than the one that was authenticated.
   • DThe user is not a member of the allowed group in AD.
   Reveal Solution Discussion Select an answer first
6. 35application · medium · select all that apply

   A security administrator is creating an inspection policy for HTTP traffic on an ASA. The policy must enforce the following: block requests with certain URL patterns, limit the maximum URI length, and allow only specific HTTP methods. Which of the following actions should be included in the HTTP inspection policy map? (Select all that apply.)

   • AEnable HTTP inspection globally without a policy map.
   • BDefine allowed HTTP methods and set the action to drop for others.
   • CSet the maximum URI length parameter to the desired value.
   • DConfigure a regex match for the URL patterns and set the action to reset.
   • EUse an access-list to block the URL patterns.
   Check answers Discussion Select an answer first