1.2 Firewall Features on Cisco ASA and FTD CCIE-SECURITY Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   An engineer is troubleshooting asymmetric traffic flow through an ASA. The inside host 10.1.1.10 initiates a connection to an outside server 203.0.113.5. The ASA has a static NAT for the inside host (10.1.1.10 -> 198.51.100.10) and a static NAT for the outside server (203.0.113.5 -> 172.16.1.5) to allow return traffic. The connection fails. The engineer suspects the NAT configuration is not handling the return traffic correctly. Which NAT type should be used to ensure bidirectional translation for both source and destination?

   • ATwice NAT with both source and destination translation in a single rule.
   • BIdentity NAT for both hosts.
   • CSource NAT for the inside host and destination NAT for the outside server.
   • DPolicy NAT based on destination port.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   An engineer is configuring NAT on an FTD device. They have a requirement to translate both the source and destination addresses for a specific traffic flow between two internal networks. The source network 10.0.0.0/24 should be translated to 192.168.1.0/24, and the destination network 172.16.0.0/16 should be translated to 10.10.0.0/16. Which NAT type should be used?

   • ASource NAT
   • BIdentity NAT
   • CDestination NAT
   • DTwice NAT
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security administrator is configuring an ASA to inspect FTP traffic. The requirement is to enforce strict compliance with FTP RFC standards and to block FTP commands that are not allowed by corporate policy. The administrator has already created an inspection policy map. What additional configuration is needed to enforce the FTP command filtering?

   • AUse a service policy to apply the inspection policy map to the interface.
   • BEnable FTP inspection globally with default settings.
   • CApply the inspection policy map to the FTP inspection command.
   • DCreate an access-list to block FTP commands.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A large enterprise uses an ASA to inspect HTTP traffic. They have a requirement to block HTTP requests that contain certain URL patterns and to enforce a maximum URI length. They also need to allow HTTP traffic only from specific source networks. The administrator has created an HTTP inspection policy map. Which of the following configurations is necessary to enforce the URL filtering and URI length limit?

   • AEnable HTTP inspection with default settings and rely on the firewall's URL filtering feature.
   • BUse an access-list to block the URL patterns and a separate policy to limit URI length.
   • CConfigure the HTTP inspection policy map with regex match and URI length actions, and apply it to the HTTP inspection command.
   • DCreate a service policy that applies the HTTP inspection policy map to the interface, but do not attach it to the inspect command.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An organization is deploying FTD in a multi-tenant environment. They need to group interfaces into different security zones to apply distinct security policies. The administrator has created two zones: 'Inside' and 'Outside'. Which configuration step is required to enforce zone-based policies?

   • AAssign interfaces to the zones and then create access control rules based on zones.
   • BCreate a security policy that references the zone names directly without assigning interfaces.
   • CDefine zones in the ASA and use them in NAT rules only.
   • DUse a global policy that applies to all interfaces regardless of zone.
   Reveal Solution Discussion Select an answer first