A Cisco ASA has an ACL applied to the outside interface that permits only HTTP and HTTPS inbound to a web server. The web server also needs to be pinged for monitoring. The administrator adds an ACL entry to permit ICMP to the web server, but pings still fail. What is the most likely reason?

The web server is not responding to ICMP.

The ACL is applied in the inbound direction, but ICMP replies are blocked by the outbound ACL.

The ICMP inspection is not enabled on the ASA.

The ACL entry is placed after a deny statement that blocks ICMP.

A small business uses a Cisco FTD appliance as its internet gateway. Internal hosts use private IP addresses (192.168.1.0/24) and need to access the internet. The FTD has a single public IP address on its outside interface. The administrator must configure NAT so that all internal hosts can share the public IP for outbound internet access. Which NAT configuration should be used?

Dynamic NAT with a pool of public IPs.

Dynamic PAT using the outside interface IP address.

Static NAT for each internal host to a unique public IP.

Identity NAT to allow internal hosts to use their private IPs on the internet.

A pair of Cisco ASA firewalls is configured in Active/Standby failover. The failover link is a dedicated GigabitEthernet interface. The primary unit fails, and the standby becomes active. However, the new active unit does not pass traffic. The administrator checks the interface status and sees that the outside interface is down. What is the most likely cause?

The switch port connected to the standby's outside interface is not configured correctly.

The outside interface on the standby was not configured with the same IP address as the primary.

The failover link is not carrying the interface state information.

The outside interface is not monitored by the failover mechanism.

An enterprise runs two Cisco ASA firewalls in an Active/Standby failover pair. The primary unit fails, and the standby takes over. After the failover, users report that they cannot reach the internet. The outside interface IP address is the same on both units, but the default route is not being advertised. What is the most likely cause of the connectivity loss?

The default route is not included in the failover configuration because it is a static route.

The failover link is down, preventing state synchronization.

The outside interface on the standby is not monitored by the failover mechanism.

The standby unit does not have the same static route configuration as the primary.

A company wants to connect two branch offices over the internet using Cisco ASA firewalls. Each branch has a static public IP address. The traffic between the branches must be encrypted and should include all IP traffic between the two sites. Which VPN configuration is most appropriate?

Dynamic multipoint VPN (DMVPN) on the ASA.

Remote access VPN using AnyConnect.

Site-to-site IPsec VPN with pre-shared keys.

CCIE Security

Domain 1Objective 11

1.11 Network Connectivity Through Cisco ASA and Cisco FTD CCIE-SECURITY Practice Questions (Page 6)

Part of the 1.0 Perimeter Security and Intrusion Prevention domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

8concepts

20%of the exam

Questions 26–30

26expert · medium
A Cisco ASA has an ACL applied to the outside interface that permits only HTTP and HTTPS inbound to a web server. The web server also needs to be pinged for monitoring. The administrator adds an ACL entry to permit ICMP to the web server, but pings still fail. What is the most likely reason?
Select an answer first
27application · medium
A small business uses a Cisco FTD appliance as its internet gateway. Internal hosts use private IP addresses (192.168.1.0/24) and need to access the internet. The FTD has a single public IP address on its outside interface. The administrator must configure NAT so that all internal hosts can share the public IP for outbound internet access. Which NAT configuration should be used?
Select an answer first
28expert · medium
A pair of Cisco ASA firewalls is configured in Active/Standby failover. The failover link is a dedicated GigabitEthernet interface. The primary unit fails, and the standby becomes active. However, the new active unit does not pass traffic. The administrator checks the interface status and sees that the outside interface is down. What is the most likely cause?
Select an answer first
29application · medium
An enterprise runs two Cisco ASA firewalls in an Active/Standby failover pair. The primary unit fails, and the standby takes over. After the failover, users report that they cannot reach the internet. The outside interface IP address is the same on both units, but the default route is not being advertised. What is the most likely cause of the connectivity loss?
Select an answer first
30application · medium
A company wants to connect two branch offices over the internet using Cisco ASA firewalls. Each branch has a static public IP address. The traffic between the branches must be encrypted and should include all IP traffic between the two sites. Which VPN configuration is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.

1.11 Network Connectivity Through Cisco ASA and Cisco FTD CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

A Cisco ASA has an ACL applied to the outside interface that permits only HTTP and HTTPS inbound to a web server. The web server also needs to be pinged for monitoring. The administrator adds an ACL entry to permit ICMP to the web server, but pings still fail. What is the most likely reason?

A company wants to connect two branch offices over the internet using Cisco ASA firewalls. Each branch has a static public IP address. The traffic between the branches must be encrypted and should include all IP traffic between the two sites. Which VPN configuration is most appropriate?

Keep studying — 1.0 Perimeter Security and Intrusion Prevention