1.9 Policies and Rules for Traffic Control on Cisco ASA and Cisco FTD CCIE-SECURITY Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company wants to block access to all websites in the 'Social Networking' category, but allow access to all other categories. The FTD is configured with a DNS and URL filtering policy. Which configuration is correct?

   • ACreate a QoS policy that drops traffic to the 'Social Networking' category.
   • BCreate an access control rule that denies traffic to the 'Social Networking' URL category and place it above a rule that allows all other traffic.
   • CCreate a prefilter rule that blocks the 'Social Networking' category.
   • DCreate an identity policy that blocks the 'Social Networking' category.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An organization needs to ensure that VoIP traffic gets priority over regular web traffic on their FTD. They have already classified the traffic. Which FTD feature should be used to implement this priority?

   • AIdentity Policy
   • BAccess Control Policy
   • CQoS Policy
   • DPrefilter Policy
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An ASA has the following ACL applied to the outside interface: 1. permit tcp any host 10.1.1.10 eq 80 2. permit tcp any host 10.1.1.10 eq 443 3. deny ip any any log A user reports they cannot access the web server at 10.1.1.10 on TCP/8080. The administrator checks the logs and sees that the traffic is being denied by the implicit deny rule, not the explicit deny. What is the most likely reason for this?

   • AThe explicit deny rule is not logging because it is not the last rule in the ACL.
   • BThe ACL is not applied to the correct interface.
   • CThe traffic is being denied by the implicit deny rule, which is not logged by default.
   • DThe web server is not listening on TCP/8080.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An ASA is configured with an MPF policy that inspects HTTP traffic. A new requirement is to also inspect HTTPS traffic, but only for a specific server (10.1.1.20). The administrator creates a new class that matches traffic to 10.1.1.20 on TCP/443 and applies the 'inspect https' action. However, the HTTPS traffic is not being inspected. What is the most likely cause?

   • AThe 'inspect https' action is not a valid action in MPF.
   • BThe new class is not being matched because the traffic is encrypted.
   • CThe traffic is being denied by an ACL before it reaches the MPF policy.
   • DThe new policy is placed after the default global policy, which is already inspecting all traffic.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An FTD administrator is troubleshooting a connectivity issue. A user reports that they cannot access a specific internal server (10.1.1.50) from the internet. The administrator has verified that the access control policy has a rule that permits this traffic. However, the traffic is still being blocked. What is the next most likely place to check?

   • AThe identity policy, which may be denying the traffic based on user identity.
   • BThe SSL decryption policy, which may be failing to decrypt the traffic.
   • CThe prefilter policy, which may be blocking the traffic before it reaches the access control policy.
   • DThe QoS policy, which may be dropping the traffic due to bandwidth limits.
   Reveal Solution Discussion Select an answer first