1.11 Network Connectivity Through Cisco ASA and Cisco FTD CCIE-SECURITY Practice Questions (Page 9)

Questions 41–45

1. 41expert · medium

   A company has a Cisco ASA with three interfaces: inside (192.168.1.0/24), outside (public IP 203.0.113.1), and DMZ (10.0.0.0/24). They want to allow internal users to access the internet and also host a web server in the DMZ (10.0.0.5) that must be reachable from the internet via the public IP 203.0.113.1. Additionally, they want to allow internal users to access the DMZ server using its private IP. The security policy requires that all traffic from the internet to the DMZ be restricted to HTTPS only. What is the correct NAT and ACL configuration?

   • AConfigure static NAT for the inside network and dynamic PAT for the DMZ server.
   • BConfigure dynamic PAT for the inside network to the outside interface IP, static NAT for the DMZ server to 203.0.113.1, and an ACL permitting HTTPS from the internet to the DMZ server.
   • CConfigure no NAT and rely on routing.
   • DConfigure dynamic NAT for the inside network to a pool of public IPs and static NAT for the DMZ server to a different public IP.
   Reveal Solution Discussion Select an answer first
2. 42expert · medium

   A company is deploying two Cisco ASA firewalls in an Active/Standby failover pair. They have a dedicated failover link and also use the data interfaces for failover communication. The administrator wants to ensure that if the active unit fails, the standby unit takes over the same IP addresses and maintains stateful connections. What is required for stateful failover?

   • AConfigure a VPN tunnel between the two units.
   • BUse the same MAC addresses on both units.
   • CConfigure the failover link to carry state information and enable stateful failover.
   • DEnable clustering instead of failover.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A branch office uses a Cisco ASA with a single public IP address on the outside interface. Internal users on the 192.168.1.0/24 network need to access the internet. The security policy requires that all outbound traffic be translated to the public IP, but the ASA must also allow inbound traffic to a public web server located inside the DMZ (10.0.0.5). Which configuration approach satisfies both requirements?

   • AConfigure PAT for the inside network and place the web server on the inside network with no NAT.
   • BConfigure dynamic NAT for the inside network to a pool of public IPs, and static NAT for the DMZ server to a different public IP.
   • CConfigure dynamic PAT for the inside network to the outside interface IP, and configure static NAT for the DMZ web server to the same public IP with an access-list permitting inbound HTTPS.
   • DConfigure static NAT for the inside network and dynamic PAT for the DMZ server.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   An organization is deploying two Cisco ASA firewalls in an Active/Standby failover pair. They want to ensure that if the active unit fails, the standby unit takes over with minimal disruption. The network uses a single inside and outside interface, and the firewalls are connected via a dedicated failover link. What is the minimum configuration required to enable failover?

   • AEnable clustering instead of failover.
   • BConfigure the failover link and use different IP addresses on each unit's interfaces.
   • CConfigure the failover link, set the failover mode to Active/Standby, and assign the same interface IP addresses to both units.
   • DConfigure a VPN tunnel between the two units for failover.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company wants to connect its headquarters and a remote branch office over the internet using a site-to-site VPN. The headquarters uses a Cisco FTD, and the branch uses a Cisco ASA. The internal networks are 10.1.0.0/16 and 10.2.0.0/16 respectively. The security team wants to ensure that only traffic between these two networks is allowed through the VPN, and that all other traffic is blocked. What should be configured on both devices?

   • AConfigure a site-to-site VPN using dynamic routing (OSPF) over the tunnel, and rely on routing to control traffic.
   • BConfigure a remote access VPN and allow all traffic from the branch to the HQ.
   • CConfigure a site-to-site VPN with no access-list, allowing all traffic between the two sites.
   • DConfigure a site-to-site VPN with a crypto map that matches the two internal networks, and apply an access-list that permits only that traffic.
   Reveal Solution Discussion Select an answer first