1.9 Policies and Rules for Traffic Control on Cisco ASA and Cisco FTD CCIE-SECURITY Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An administrator needs to apply different inspection policies to traffic based on the destination port. For example, HTTP traffic to a specific server should have deeper inspection than HTTP traffic to other servers. Which ASA feature is best suited for this requirement?

   • AA standard ACL applied to the interface
   • BModular Policy Framework (MPF)
   • CA global inspection policy
   • DAn object group for the server
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team needs to ensure that all FTP traffic passing through the ASA is inspected to prevent common FTP-based attacks. They also want to log any FTP traffic that is denied. Which configuration is required?

   • ACreate an MPF policy that matches FTP traffic and applies the 'inspect ftp' action, then add a logging action to the policy.
   • BCreate an ACL that permits FTP traffic and apply it to the interface.
   • CApply a global 'inspect ftp' command and rely on the default logging.
   • DUse the 'fixup protocol ftp' command in global configuration.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An FTD administrator is creating an access control policy to allow internal users to access the internet, but block access to a specific social media site. The administrator has already created a URL object for the site. What is the correct order of rules in the access control policy?

   • APlace the rule that blocks the social media site before the rule that allows general internet access.
   • BPlace the block rule in a prefilter policy instead.
   • CPlace the rule that allows general internet access before the block rule.
   • DThe order does not matter, as FTD uses a best-match algorithm.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An FTD administrator wants to drop all traffic from a known malicious IP address before it is processed by the access control policy, to reduce CPU load. Which feature should be used?

   • AAccess Control Policy
   • BSSL Decryption Policy
   • CPrefilter Policy
   • DIdentity Policy
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An organization wants to detect and block known exploit attempts against its web servers. The FTD is already in place, and the access control policy allows traffic to the web servers. What additional configuration is required to enable this protection?

   • AEnable SSL decryption for the web server traffic.
   • BCreate a new access control rule that blocks all traffic to the web servers.
   • CCreate an Intrusion Prevention Policy (IPS) and attach it to the access control rule that permits traffic to the web servers.
   • DConfigure a QoS policy to prioritize web server traffic.
   Reveal Solution Discussion Select an answer first