1.2 Firewall Features on Cisco ASA and FTD CCIE-SECURITY Practice Questions (Page 9)

Questions 41–44

1. 41application · medium

   A network engineer is configuring zone-based firewall policies on an ASA. They have three zones: Inside, Outside, and DMZ. They want to allow HTTP traffic from Inside to DMZ, but block all other traffic from Inside to DMZ. They also want to inspect HTTP traffic. Which configuration approach is correct?

   • AApply a global service policy that allows HTTP and inspects it.
   • BCreate a single zone pair for all traffic and use access-lists to filter.
   • CCreate a zone pair for Inside-to-DMZ and apply a service policy that allows HTTP and inspects it.
   • DUse NAT to control traffic between zones.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company has two internet service providers (ISPs) connected to their ASA. They want to route traffic from the internal network to the primary ISP, but traffic from a specific server (10.10.10.5) should be sent to the secondary ISP for compliance reasons. Which feature should be used to achieve this?

   • ANAT with a route map to send traffic to the secondary ISP.
   • BPolicy-based routing (PBR) with a route map that matches the source IP and sets the next hop to the secondary ISP.
   • CStatic route with a higher administrative distance for the secondary ISP.
   • DA zone-based policy to redirect traffic to the secondary ISP.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   An engineer is implementing PBR on an FTD device. The route map 'PBR-1' matches traffic from subnet 192.168.10.0/24 and sets the next hop to 10.0.0.1. However, after applying the PBR to the ingress interface, traffic from that subnet is still being forwarded using the routing table. The engineer has verified that the route map is correctly configured and applied. What is the most likely cause of the issue?

   • AThe route map is not applied to the correct interface or direction.
   • BThe traffic is being NATed before PBR is applied.
   • CThe route map is using an ACL that matches the wrong subnet.
   • DThe route map is missing a 'set ip next-hop' command.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A security team wants to redirect all HTTP traffic from the inside interface to an ASA CX module for advanced inspection. They have already configured the ASA CX module and it is operational. What is the correct way to redirect the traffic?

   • AUse a static route to send all traffic to the ASA CX module.
   • BCreate a policy-based redirection (PBR) rule that matches HTTP traffic and sets the next hop to the ASA CX module.
   • CConfigure a NAT rule to translate the destination to the ASA CX module.
   • DApply a service policy with the 'inspect http' command and specify the ASA CX module as the destination.
   Reveal Solution Discussion Select an answer first