What is the primary purpose of enabling logging on Cisco ASA/FTD for policy monitoring?

To provide a record of traffic that is permitted or denied by access control policies

To increase the throughput of the firewall

To automatically block all traffic that is not explicitly allowed

To encrypt all traffic passing through the firewall

Which command is used on Cisco ASA to enable logging to an external syslog server?

logging host interface_name ip_address

A company's security policy requires that only the internal web server (10.1.1.10) be reachable from the public internet on TCP/443, and all other inbound traffic to the internal network must be denied. The ASA has a default implicit deny at the end of the ACL. Which ACL configuration correctly implements this policy on the outside interface?

access-list OUTSIDE_IN extended permit tcp any host 10.1.1.10 eq 80

access-list OUTSIDE_IN extended permit tcp any host 10.1.1.10 eq 443 access-list OUTSIDE_IN extended deny ip any any

access-list OUTSIDE_IN extended permit tcp any host 10.1.1.10 eq 443

access-list OUTSIDE_IN extended permit ip any host 10.1.1.10

CCIE Security

Domain 1Objective 9

1.9 Policies and Rules for Traffic Control on Cisco ASA and Cisco FTD CCIE-SECURITY Practice Questions (Page 1)

Part of the 1.0 Perimeter Security and Intrusion Prevention domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

14concepts

20%of the exam

Questions 1–5

1foundation · easy
Which logging level on Cisco ASA/FTD indicates that the system is unusable and requires immediate attention?
Select an answer first
2foundation · easy
What is the primary purpose of enabling logging on Cisco ASA/FTD for policy monitoring?
Select an answer first
3foundation · easy
Which command is used on Cisco ASA to enable logging to an external syslog server?
Select an answer first
4application · medium
A company's security policy requires that only the internal web server (10.1.1.10) be reachable from the public internet on TCP/443, and all other inbound traffic to the internal network must be denied. The ASA has a default implicit deny at the end of the ACL. Which ACL configuration correctly implements this policy on the outside interface?
Select an answer first
5application · medium
An organization needs to inspect HTTPS traffic to a specific external website for malware, but does not want to decrypt traffic to financial institutions due to compliance reasons. Which FTD feature should be used to achieve this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.

1.9 Policies and Rules for Traffic Control on Cisco ASA and Cisco FTD CCIE-SECURITY Practice Questions (Page 1)

Questions 1–5

Which logging level on Cisco ASA/FTD indicates that the system is unusable and requires immediate attention?

What is the primary purpose of enabling logging on Cisco ASA/FTD for policy monitoring?

Which command is used on Cisco ASA to enable logging to an external syslog server?

An organization needs to inspect HTTPS traffic to a specific external website for malware, but does not want to decrypt traffic to financial institutions due to compliance reasons. Which FTD feature should be used to achieve this?

Keep studying — 1.0 Perimeter Security and Intrusion Prevention