1.11 Network Connectivity Through Cisco ASA and Cisco FTD CCIE-SECURITY Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the function of an access control list (ACL) on a Cisco ASA or FTD?

   • ATo establish VPN tunnels
   • BTo provide high availability
   • CTo permit or deny traffic based on defined criteria such as source/destination IP and port
   • DTo translate private IP addresses to public IP addresses
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company is deploying a pair of Cisco ASA firewalls in a DMZ to segment a web server farm. The network team has allocated a single physical interface on each ASA for the DMZ segment, but the web servers are spread across two VLANs (VLAN 10 and VLAN 20) that must be isolated. The ASAs must route between these VLANs and also to the inside network. What configuration should be applied to the ASA interfaces to meet these requirements?

   • ACreate a single interface with an IP address and enable VLAN trunking on the switch port connected to the ASA.
   • BConfigure an EtherChannel with two physical links, one for each VLAN.
   • CUse the same physical interface for both VLANs and rely on the ASA's built-in switchport functionality.
   • DCreate two subinterfaces on the physical interface, assign each to a VLAN, and configure IP addresses in different subnets.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A remote worker needs to securely access the corporate network from a hotel Wi-Fi. The company uses Cisco FTD with AnyConnect. The user connects successfully but cannot access internal resources. The administrator checks the VPN session and sees that the user has an IP address from the VPN pool. What is the most likely cause?

   • AThe hotel Wi-Fi is blocking VPN traffic.
   • BThe VPN ACL is not permitting traffic to the internal network.
   • CThe FTD is not performing NAT for VPN traffic.
   • DThe user's device is not running the latest AnyConnect version.
   Reveal Solution Discussion Select an answer first
5. 19expert · medium

   A Cisco FTD is configured with dynamic PAT for outbound internet access. Users report that some websites fail to load intermittently. The administrator notices that the PAT pool is exhausted. What is the best solution to resolve this issue?

   • AEnable NAT rebinding to reuse ports more aggressively.
   • BConfigure multiple PAT pools and distribute traffic across them.
   • CIncrease the PAT pool by adding more public IP addresses.
   • DReduce the PAT timeout to free up ports faster.
   Reveal Solution Discussion Select an answer first
6. 20expert · medium

   Two Cisco ASA firewalls are configured in Active/Standby failover. The primary unit has a static route to an internal network via a router. The standby unit does not have this route. After a failover, traffic to that internal network fails. What is the best way to prevent this in the future?

   • AManually add the route to the standby unit.
   • BUse a floating static route on the standby with a higher metric.
   • CEnsure the failover configuration is synchronized and the standby has the same configuration.
   • DUse a dynamic routing protocol so both units learn the route.
   Reveal Solution Discussion Select an answer first