A network engineer is designing a zone-based firewall for a small office. The inside network (trusted) and the outside network (untrusted) are separate zones. The goal is to allow the inside zone to initiate all traffic to the outside, but block any unsolicited inbound traffic. What is the minimum configuration required?

Configure NAT to hide the inside network

Create a zone pair from inside to outside with a policy allowing all traffic, and no zone pair for the reverse direction

Apply an ACL on the outside interface to block inbound traffic

Create zone pairs in both directions with policies allowing all traffic

An administrator is configuring a zone-based firewall on a Cisco router. They need to allow HTTP traffic from the inside zone to the DMZ zone, but also need to log all denied traffic. The policy map already has a class for HTTP. What is the correct way to apply the policy and ensure logging?

Use an ACL on the DMZ interface to block and log traffic

Apply the policy map directly to the inside interface

Create a zone pair for inside-to-DMZ, attach the policy map, and add a 'log' option to the deny class

Enable logging globally on the router

A security engineer is implementing a zone-based firewall on a router that connects the internal network to the internet. They want to allow internal users to browse the web and use DNS, but also want to inspect FTP traffic for malicious content. What is the best approach?

Use the 'pass' action for all traffic to avoid inspection overhead

Create separate zone pairs for each protocol

Create a class map for HTTP, DNS, and FTP, and use the 'inspect' action in the policy map

Apply an ACL to allow the traffic and rely on the ISP firewall

A network administrator has configured a zone-based firewall and wants to monitor traffic flows and see which applications are being blocked. They need real-time visibility without using an external collector. What should they use?

Use 'debug ip inspect' to see all traffic

Use the 'show policy-map type inspect zone-pair' command to see traffic counters and drops

Check the routing table for dropped routes

Enable NetFlow and send to a collector

CCIE Security

Domain 1Objective 3

1.3 Security Features on Cisco IOS/IOS XE CCIE-SECURITY Practice Questions (Page 8)

Part of the 1.0 Perimeter Security and Intrusion Prevention domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

11concepts

20%of the exam

Questions 36–40

36application · medium
A network engineer is designing a zone-based firewall for a small office. The inside network (trusted) and the outside network (untrusted) are separate zones. The goal is to allow the inside zone to initiate all traffic to the outside, but block any unsolicited inbound traffic. What is the minimum configuration required?
Select an answer first
37application · medium
An administrator is configuring a zone-based firewall on a Cisco router. They need to allow HTTP traffic from the inside zone to the DMZ zone, but also need to log all denied traffic. The policy map already has a class for HTTP. What is the correct way to apply the policy and ensure logging?
Select an answer first
38application · medium
A security engineer is implementing a zone-based firewall on a router that connects the internal network to the internet. They want to allow internal users to browse the web and use DNS, but also want to inspect FTP traffic for malicious content. What is the best approach?
Select an answer first
39application · medium
A network administrator has configured a zone-based firewall and wants to monitor traffic flows and see which applications are being blocked. They need real-time visibility without using an external collector. What should they use?
Select an answer first
40application · easy
A company has a public web server that must be reachable from the internet using a specific public IP address. The server's private IP is 192.168.1.10, and the public IP is 203.0.113.5. The administrator wants to ensure that the server always uses the same public IP. What type of NAT should be configured?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.

1.3 Security Features on Cisco IOS/IOS XE CCIE-SECURITY Practice Questions (Page 8)

Questions 36–40

An administrator is configuring a zone-based firewall on a Cisco router. They need to allow HTTP traffic from the inside zone to the DMZ zone, but also need to log all denied traffic. The policy map already has a class for HTTP. What is the correct way to apply the policy and ensure logging?

A security engineer is implementing a zone-based firewall on a router that connects the internal network to the internet. They want to allow internal users to browse the web and use DNS, but also want to inspect FTP traffic for malicious content. What is the best approach?

A network administrator has configured a zone-based firewall and wants to monitor traffic flows and see which applications are being blocked. They need real-time visibility without using an external collector. What should they use?

Keep studying — 1.0 Perimeter Security and Intrusion Prevention