1.9 Policies and Rules for Traffic Control on Cisco ASA and Cisco FTD CCIE-SECURITY Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An FTD is configured to decrypt and inspect HTTPS traffic. After enabling this, the administrator notices that some users are unable to access certain websites that use certificate pinning. The access control policy is set to 'Allow' for these sites. What is the most likely cause of the issue?

   • AThe DNS policy is resolving the website to the wrong IP address.
   • BThe access control policy is blocking the traffic after decryption.
   • CThe intrusion prevention policy is blocking the traffic.
   • DThe SSL decryption policy is breaking the certificate chain, causing the client to reject the connection.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An FTD administrator is configuring URL filtering. They have created a rule that blocks the 'Social Networking' category. However, users are still able to access Facebook. The administrator has verified that the rule is enabled and placed at the top of the access control policy. What is the most likely reason for this?

   • AThe traffic is being allowed by a prefilter rule before it reaches the access control policy.
   • BThe URL category for Facebook is not correctly identified by the FTD.
   • CThe SSL decryption policy is not decrypting the traffic, so the URL cannot be inspected.
   • DThe DNS policy is resolving Facebook to an IP address that is not in the URL category database.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An FTD administrator is configuring QoS to prioritize VoIP traffic. They have created a QoS policy that assigns a higher priority to VoIP traffic. However, they notice that VoIP traffic is still experiencing latency. What is the most likely cause?

   • AThe access control policy is not allowing the VoIP traffic to be classified correctly for QoS.
   • BThe prefilter policy is dropping the VoIP traffic.
   • CThe QoS policy is not applied to the correct interface.
   • DThe intrusion prevention policy is inspecting the VoIP traffic and adding latency.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An administrator needs to create an ACL on an ASA to allow traffic from the 192.168.10.0/24 and 192.168.20.0/24 networks to reach a server at 10.10.10.5 on ports TCP/80 and TCP/443. The administrator wants to minimize the number of ACEs and simplify future changes. Which approach is the most efficient?

   • ACreate two separate ACEs, one for each source network, each permitting both ports.
   • BUse a single ACE with a wildcard mask to match both source networks.
   • CCreate a single ACE that permits all IP traffic from the source networks to the server.
   • DCreate a network object group containing both source networks and a service object group for ports 80 and 443, then use a single ACE.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company wants to allow remote employees to access the corporate network via VPN only during business hours (Monday to Friday, 8:00 AM to 6:00 PM). The ASA ACL currently has a permit statement for VPN traffic. What is the correct way to enforce this time restriction?

   • AUse the 'clock' command to manually disable the ACL outside business hours.
   • BConfigure the VPN group policy to restrict access based on time.
   • CCreate a new ACL with the time-range and remove the old one.
   • DApply a time-range to the existing ACL permit statement that specifies the business hours.
   Reveal Solution Discussion Select an answer first