1.11 Network Connectivity Through Cisco ASA and Cisco FTD CCIE-SECURITY Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company is deploying a new Cisco FTD appliance as the perimeter firewall. The inside network uses VLAN 10 (192.168.10.0/24) and VLAN 20 (192.168.20.0/24). The FTD has one physical interface connected to the inside switch. The network team wants to route between the two VLANs through the FTD and then to the upstream router. What is the most efficient way to configure the FTD to achieve this connectivity?

   • ACreate two subinterfaces on the physical interface, assign each to a VLAN, and configure IP addresses in the respective subnets.
   • BCreate a single interface with an IP address in one subnet and rely on the switch to route between VLANs.
   • CUse the physical interface as an access port for VLAN 10 and configure a separate VLAN interface for VLAN 20.
   • DConfigure an EtherChannel with two VLANs on the same physical interface.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company is setting up two Cisco ASA firewalls in an Active/Standby failover pair. They have a dedicated failover link and also use the data interfaces for failover communication. The administrator wants to ensure that if the active unit fails, the standby unit takes over the same IP addresses and maintains stateful connections. What is required for stateful failover?

   • AConfigure a VPN tunnel between the two units.
   • BConfigure the failover link to carry state information and enable stateful failover.
   • CEnable clustering instead of failover.
   • DUse the same MAC addresses on both units.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A remote worker needs to connect to the corporate network using a VPN client. The company uses a Cisco ASA with AnyConnect. The user can connect to the VPN but cannot access any internal resources. The administrator has verified that the VPN tunnel is up and the user has been assigned an IP address. What is the most likely cause?

   • AThe ASA is not performing NAT for VPN traffic.
   • BThe group policy does not include the correct split-tunnel ACL or the internal networks are not routed through the VPN.
   • CThe user's IP address is not in the same subnet as the internal network.
   • DThe user's computer has a firewall blocking VPN traffic.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A network administrator is troubleshooting a connectivity issue on a Cisco FTD. Users on the inside network can access the internet, but they cannot access a specific external server. The administrator has verified that the NAT and routing are correct. What is the next best step to identify the problem?

   • AReboot the FTD to clear any temporary issues.
   • BUse the capture command to capture traffic on the inside and outside interfaces and compare the packets.
   • CRemove the NAT policy and test again.
   • DCheck the routing table on the external server.
   Reveal Solution Discussion Select an answer first
6. 40expert · medium

   A large enterprise is deploying a pair of Cisco FTDs in a cluster. They have two upstream ISPs for redundancy. The FTDs will run BGP to the ISPs and OSPF to the internal network. The internal network has multiple VLANs, and the FTDs will use subinterfaces for each VLAN. The security policy requires that all traffic from the internal network to the internet be inspected, but traffic between internal VLANs should be allowed without inspection. What is the best way to configure the FTDs to meet these requirements?

   • AUse static routing instead of dynamic routing to simplify the configuration.
   • BConfigure BGP on the subinterfaces and OSPF to the ISPs.
   • CUse a single interface for all VLANs and rely on the switch to route between them.
   • DCreate subinterfaces for each VLAN, configure OSPF on the subinterfaces, and use BGP to the ISPs. Apply a security policy that inspects traffic going to the internet and allows inter-VLAN traffic.
   Reveal Solution Discussion Select an answer first