1.11 Network Connectivity Through Cisco ASA and Cisco FTD CCIE-SECURITY Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A network administrator is troubleshooting a connectivity issue on a Cisco ASA. Users on the inside network (192.168.1.0/24) cannot reach the internet. The administrator has verified that the default route is configured and the NAT policy is in place. However, traffic is still not passing. What is the next best step to isolate the problem?

   • AUse the packet tracer tool to simulate traffic from an inside host to an outside destination and examine the result.
   • BReboot the ASA to clear any temporary issues.
   • CRemove the NAT policy and test again.
   • DCheck the routing table on the inside router.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A data center is deploying a pair of Cisco FTDs in a cluster for high availability. Each FTD has four 10-Gigabit Ethernet interfaces that will be used for data traffic. The cluster needs to provide a total of 40 Gbps throughput. To achieve this, the interfaces on each FTD should be combined into a single logical link. What is the correct way to configure this on FTD?

   • AEnable clustering and assign each interface to a different cluster node.
   • BConfigure each interface as a separate subinterface and use policy-based routing to load-balance.
   • CCreate an EtherChannel by grouping the four interfaces into a port-channel interface on each FTD.
   • DUse the four interfaces as separate routed interfaces and rely on ECMP routing to load-balance.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A Cisco ASA is configured with OSPF as the routing protocol on the inside interface. The outside interface uses a static default route to the ISP. The administrator notices that OSPF routes are not being installed in the routing table. What is a likely cause?

   • AThe ASA is in transparent mode.
   • BOSPF is not enabled on the inside interface or the network statement is missing.
   • CThe ACL on the inside interface is blocking OSPF packets.
   • DThe default route is overriding OSPF routes.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A company has a Cisco FTD with three interfaces: inside (192.168.1.0/24), outside (public IP), and DMZ (10.0.0.0/24). They want to allow internal users to access the internet and also allow external users to access a web server in the DMZ. The web server has a private IP (10.0.0.5) and must be reachable via the public IP. What NAT configuration is required?

   • AConfigure no NAT and rely on routing.
   • BConfigure dynamic PAT for the inside network to the outside interface IP, and static NAT for the DMZ server to the public IP.
   • CConfigure dynamic NAT for the inside network to a pool of public IPs, and static NAT for the DMZ server to a different public IP.
   • DConfigure static NAT for the inside network and dynamic PAT for the DMZ server.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A Cisco ASA is configured with an access-list that permits HTTP traffic from the inside network to the outside network. However, users are unable to browse the internet. The administrator checks the NAT configuration and finds that PAT is configured. What is the most likely reason for the failure?

   • AThe HTTP traffic is being blocked by the outside router.
   • BThe access-list is applied to the wrong interface or direction.
   • CThe default route is missing.
   • DThe PAT configuration is using the wrong interface IP.
   Reveal Solution Discussion Select an answer first