1.11 Network Connectivity Through Cisco ASA and Cisco FTD CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   Users on a protected network cannot reach a public web server. The Cisco ASA has an ACL that permits HTTP traffic from the inside to the outside. The administrator runs the packet tracer tool and sees that the packet is dropped at the ACL stage. What is the most likely cause?

   • AThe default route is missing.
   • BThe web server is down.
   • CThe packet tracer does not simulate NAT, so it always drops.
   • DThe ACL is applied to the wrong interface or direction.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A Cisco FTD is deployed as a router between two networks: 10.1.1.0/24 and 10.2.2.0/24. The FTD has interfaces in both subnets. The administrator wants to enable communication between the two networks without using dynamic routing. What is the simplest configuration?

   • AUse a NAT policy to translate between the two networks.
   • BConfigure a default route on the FTD only.
   • CConfigure a static route on each side pointing to the FTD's interface IP.
   • DEnable OSPF on both interfaces.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company runs a web server in a DMZ behind a Cisco ASA. The web server has a private IP address (192.168.2.10) and needs to be accessible from the internet via a public IP (203.0.113.10). The administrator must configure NAT so that internet users can reach the web server. Which NAT configuration is required?

   • ADynamic NAT with a pool of public IPs.
   • BStatic NAT (one-to-one) mapping the public IP to the private IP.
   • CIdentity NAT to allow the web server to use its private IP on the internet.
   • DDynamic PAT using the outside interface IP.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A Cisco ASA has an ACL that permits only HTTP and HTTPS traffic from the inside to the outside. Users report that they can browse websites but cannot ping external IP addresses. The administrator wants to allow ICMP echo requests for troubleshooting. What should be done?

   • AUse the packet tracer to verify the ACL.
   • BChange the ACL to permit all IP traffic.
   • CEnable ICMP inspection on the ASA.
   • DAdd an ACL entry to permit ICMP from the inside to the outside.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An organization is deploying two Cisco FTD appliances in a cluster to provide high availability and increased throughput. The cluster will be placed between the core switch and the internet router. What is a key requirement for the cluster interfaces?

   • AThe cluster control link must be a dedicated physical interface on each member.
   • BAll cluster members must have identical interface configurations, including IP addresses.
   • CEach cluster member should have a unique IP address on the same subnet.
   • DThe cluster members must be connected to the same switch for all interfaces.
   Reveal Solution Discussion Select an answer first