Management And Troubleshooting

An administrator successfully restores an FMC backup onto a freshly deployed FMC virtual appliance of the exact same software version. However, after the restore completes, all managed FTD devices show a status of 'Offline' or 'Config Apply Failed'. What is the most likely root cause and correct resolution?

An administrator needs to troubleshoot a routing issue on an FTD device managed by FMC. Where in the FMC GUI should the administrator navigate to view and modify static and dynamic routing configurations for the device?

An FTD device is dropping packets unexpectedly. An engineer runs a packet tracer via the FTD diagnostic CLI using 'system support diagnostic-cli' and enters the command: 'packet-tracer input inside tcp 192.168.1.50 12345 10.0.0.5 80'. The output shows a drop at the 'Access-Rule' phase with the action 'DROP'. What does this indicate?

An administrator notices that the Firepower Management Center (FMC) health monitor shows a critical warning regarding high disk utilization on the /var partition. Which built-in utility or action should the administrator perform first to safely free up disk space without disrupting critical database integrity?

During a routine backup of the FMC, the administrator wants to ensure that the generated backup file contains critical historical events, configurations, and intrusion event data so that it can be fully restored to a replacement appliance if necessary. Which backup type should be selected in the FMC?

An FTD device managed by FMC is experiencing high CPU utilization attributed to the Snort inspection engine. The administrator wants to identify which specific intrusion rules or access control rules are consuming the most resources. Which tool or report should the administrator use?

An engineer needs to troubleshoot an intermittent connectivity issue between a secured zone and the internet through a Firepower Threat Defense (FTD) managed by FMC. The engineer wants to capture traffic hitting a specific Access Control rule without overwhelming the system. Which packet capture configuration is most appropriate?

An administrator is preparing to upgrade a high-availability (HA) pair of Firepower Threat Defense devices managed by an FMC. Before initiating the upgrade task via the FMC upgrade tool, which preliminary action is mandatory to ensure a seamless process and prevent split-brain conditions?

An administrator is troubleshooting a scenario where Snort inspection threads on an FTD are crashing intermittently, producing core dumps. To assist Cisco TAC in root cause analysis, what is the correct sequence of tools or CLI commands to collect the necessary diagnostic data?

An engineer needs to analyze the connection history and security events from an FTD device that occurred three weeks ago. However, when querying the FMC event viewer, the events are missing. What is the most likely cause of this behavior?

An administrator wants to configure automated email notifications from the FMC whenever a critical health monitor alert occurs on any managed device. Where should this be configured in the FMC GUI?

An administrator is troubleshooting an issue where an FMC cannot communicate with a managed FTD device. The health monitor shows registration is down. The administrator checks the FTD CLI and verifies the registration key and NAT ID. Which log file on the FTD should the administrator examine to troubleshoot registration and communication daemon errors (such as sftunnel)?

An administrator needs to verify the license status and active feature subscriptions (such as URL Filtering, Malware, and IPS) on an FMC. Where should the administrator check this information in the FMC GUI?

An engineer deploys an Access Control Policy change from the FMC to a managed FTD device. The task hangs in the Deployment History with a status of 'Applying' for an extended period. Upon checking the FTD CLI, the engineer notices a locked deployment file or stuck process. What action should be taken to clear or restart the deployment process safely?

An administrator wants to verify the NTP synchronization status and time offset on a managed FTD device from the FMC GUI. Where can this health and system information be viewed?

An administrator is troubleshooting asymmetric routing issues across an FTD firewall using the FMC connection events and FTD CLI. The administrator wants to disable TCP state bypass or adjust TCP normalization settings to allow non-synchronized SYN packets through for a specific application. Where are TCP normalization and stateful inspection parameters configured for FTD?

An FMC managed deployment is experiencing slow GUI performance and delayed event reporting. The administrator suspects database table bloat in the FMC PostgreSQL database. Which utility or command can the administrator run from the FMC expert shell to analyze and vacuum/optimize the database safely?

An administrator is troubleshooting a VPN tunnel termination issue on an FTD device. To check IPsec Phase 1 and Phase 2 security associations (SAs) and real-time crypto debugging messages, which command should be executed on the FTD diagnostic CLI?

An engineer has modified several access control rules and object groups on the FMC. Before deploying these changes to the FTD, the engineer wants to review all pending changes to ensure no unauthorized modifications are included. Where in the FMC GUI should the engineer go to view pending deployment changes?

An FTD high-availability pair is experiencing split-brain behavior due to a unidirectional failure of the state and heartbeat links. As a result, both units are claiming to be Active. Which CLI command on the FTD should an administrator use to troubleshoot interface failover status and verify interface health across the failover link?

An administrator wants to check the status of all software processes running on an FMC appliance (such as the web server, database, and event handlers) to ensure everything is running smoothly. Which command should be run in the FMC CLI?

An administrator needs to schedule automated weekly backups of the FMC configuration and store them securely on a remote SCP server. Where is remote backup storage configured in the FMC GUI?

An FTD device managed by FMC is failing to download latest Snort Rule Updates (SRUs) and GeoDB updates automatically. The FMC has internet access via an HTTPS proxy. Where must the HTTPS proxy settings be configured on the FMC so that it can successfully reach Cisco update servers?

An administrator is troubleshooting a memory leak on an FTD virtual appliance. The administrator wants to inspect real-time memory usage of individual system processes and identify top memory-consuming tasks. Which command should be run in the FTD expert mode shell?

An engineer needs to troubleshoot connectivity through an FTD firewall and wants to use the FTD packet tracer utility. Which THREE parameters are required when executing a basic packet tracer command from the diagnostic CLI? (Choose three)

An administrator is performing health monitoring on an FMC appliance. Which TWO health monitors are available out-of-the-box in the FMC Health Monitor dashboard to track system resource utilization? (Choose two)

An administrator is preparing an upgrade plan for an FMC and its managed FTD devices. Which THREE best practices should be followed during the upgrade process to minimize downtime and avoid failure? (Choose three)

An administrator is configuring automated backup tasks on the FMC. Which TWO destinations or protocols are natively supported by the FMC for storing backup archives? (Choose two)

An administrator is investigating an issue where connection events are failing to reach the FMC from a managed FTD. Which THREE daemons or logs on the FTD and FMC should be checked to troubleshoot event transport and communication issues? (Choose three)

An administrator is setting up health monitoring alerts on the FMC. Which TWO notification methods can be configured when a health alert is triggered? (Choose two)

An engineer needs to troubleshoot high CPU usage on an FTD device caused by Snort. Which THREE actions or features can be adjusted or implemented to mitigate Snort CPU load? (Choose three)

An administrator is performing a backup and restore operation on an FMC appliance. Which THREE statements are correct regarding the FMC restore process? (Choose three)

An administrator wants to ensure that packet captures taken on an FTD can be analyzed easily. Which TWO ways can packet capture files (.pcap) be retrieved from the FMC? (Choose two)

An administrator is troubleshooting a policy deployment failure between an FMC and an FTD. Which THREE log files on the FTD contain relevant information regarding policy application and deployment tasks? (Choose three)

An administrator is troubleshooting an issue where Snort inspection engine crashes repeatedly on an FTD device. Which THREE diagnostic artifacts or steps should the administrator collect and perform to assist Cisco TAC in resolving the core dump issue? (Choose three)

An administrator wants to view system status and resource metrics directly on an FTD CLI without logging into the FMC. Which TWO commands are commonly used in the FTD diagnostic CLI or expert shell for this purpose? (Choose two)

An administrator is troubleshooting a high availability (HA) failover link failure between two FTD physical appliances. Which THREE checks should be performed to diagnose physical and logical connectivity between the failover interfaces? (Choose three)

An administrator is troubleshooting a policy deployment failure from the Firepower Management Center (FMC) to a managed Firepower Threat Defense (FTD) device. The deployment hangs at 33 percent with an error related to snort synchronization. Which tool should the administrator use on the FTD CLI to examine the real-time Snort rule compilation and policy application process?

An administrator is planning an upgrade of an FMC managing multiple FTD devices across various software versions. Which THREE factors must be validated according to Cisco compatibility guidelines before proceeding? (Choose three)

An FMC administrator needs to back up configuration data and event data for disaster recovery. Which backup type includes both system configurations and historical event data stored in the database?

During an upgrade of an FTD device managed by FMC, the pre-checks fail because of insufficient disk space in the target upgrade partition. Which CLI command sequence should the administrator use to safely clean up previous upgrade installation files and temporary packages?

An administrator notices that health monitors on the FMC show a critical warning for high disk utilization on the /var partition of an FTD device. What is the safest and most standard method to resolve disk space exhaustion caused by accumulated core files and rotated logs on FTD?

An engineer suspects that asymmetric routing is causing packets to be dropped by the FTD firewall. Which command should the engineer run on the FTD CLI to check for dropped packets and view drop reasons in real time?

An FMC high availability (HA) pair has split-brain symptoms due to a management network failure. After restoring network connectivity, the standby unit remains in a 'Failed' state and does not automatically re-synchronize. What is the correct procedure to recover the HA sync?

An administrator wants to generate a health report on the FMC to present hardware utilization trends over the past 30 days. Which section of the FMC GUI provides pre-built health reports and metric tracking?

An administrator is preparing to upgrade an FMC and its managed FTD devices from version 6.6.x to 7.2.x. What is the mandatory prerequisite regarding upgrade paths and compatibility checks?

An engineer needs to troubleshoot intermittent packet loss between an FTD inside interface and a destination server. The engineer runs the 'packet-tracer' command on the FTD CLI. What limitation must the engineer keep in mind regarding packet-tracer?

An administrator notices that health alerts from managed FTD devices are not appearing in the FMC health monitor, although traffic logs are updating normally. Which service or daemon on the FMC is primarily responsible for collecting and processing health and performance metrics from managed devices?

An FTD high availability pair experiences a failover due to a hardware failure on the active unit. After the standby unit takes over, the administrator notices that existing TCP connections were dropped and did not state-fully fail over. What configuration setting should the administrator verify?

An engineer is troubleshooting a newly deployed FTD device where syslog messages are not reaching the external syslog server. Which tool on the FTD CLI can the engineer use to verify if the syslog generation and transmission process is attempting to send packets out the management or data interface?

An administrator wants to export a packet capture (.pcap file) taken on an FTD interface directly from the FMC GUI for offline analysis in Wireshark. Where should the administrator navigate?

An administrator needs to restore an FMC configuration from a previously saved backup file. Where in the FMC GUI is the Backup/Restore utility located?

An FMC administrator is troubleshooting a scenario where device registration between an FTD and FMC fails immediately with a registration key mismatch error. The administrator verified the NAT ID and registration key. What underlying protocol handshake fails during this registration process, and how can it be debugged?

An engineer is troubleshooting a packet capture configuration on an FTD device managed by FMC. Which THREE statements regarding FTD packet capture behavior and limitations are correct? (Choose three)

An administrator is troubleshooting high memory utilization on an FMC appliance. Which TWO actions or tools can be used to identify resource-heavy processes or clean up storage? (Choose two)

An administrator is preparing to perform a system backup on the FMC. Which TWO data categories can be optionally included or excluded when generating the backup? (Choose two)

An engineer is troubleshooting a scenario where an FTD device fails its pre-upgrade health check during an upgrade initiated from the FMC. Which THREE common pre-check failures must be resolved before proceeding? (Choose three)

An administrator is analyzing a troubleshooting scenario involving Snort inspection crashes on an FTD device. Which THREE locations or tools should the administrator check to diagnose why the Snort process restarted or crashed? (Choose three)

An administrator is troubleshooting connectivity issues to the FMC web interface (HTTPS). Which TWO commands or diagnostic checks can be performed on the FMC CLI to verify web server responsiveness and port status? (Choose two)

An administrator needs to monitor the real-time health and status of managed devices from the FMC dashboard. Which TWO dashboard widgets or features are available in FMC to assist with device monitoring? (Choose two)

An administrator is troubleshooting a packet drop issue on a Firepower Threat Defense (FTD) device managed by Firepower Management Center (FMC). The administrator wants to inspect real-time packets entering and leaving specific interfaces including layer 2/3 headers and ASP drop details. Which built-in FMC feature should the administrator use?

An administrator needs to troubleshoot an issue where legitimate traffic is being silently dropped by the FTD device. The standard packet trace does not reveal the exact reason. Which command executed on the FTD CLI is best suited to diagnose accelerated security path (ASP) drops in real time?

An administrator needs to restore an FMC configuration backup onto a replacement hardware appliance. Which of the following conditions must be met for the backup restoration to succeed successfully?

An administrator notices that the FMC Health Monitor shows a 'Critical' alert for the Snort process utilization on an FTD device. What is the most appropriate first-line troubleshooting step from the FMC GUI or FTD CLI to investigate the cause of high Snort CPU usage?

An administrator is preparing to upgrade an FTD managed device using the FMC. Before initiating the upgrade, which FMC utility should be run to check for compatibility, disk space, and potential configuration blocks?

An administrator wants to configure automated backup generation on the FMC and ensure that backup archives are securely offloaded to a remote server. Where is this configured in the FMC GUI?

An administrator is troubleshooting a scenario where configuration deployment from FMC to an FTD device fails with a 'Deployment Validation Error'. Where can the administrator view the detailed validation messages and deployment task history?

An administrator is troubleshooting intermittent connectivity loss between an FTD managed device and the FMC. Which TWO methods or tools can be used to verify registration and communication status between the managed device and the FMC? (Choose two.)

An administrator is preparing to troubleshoot a complex routing and NAT issue on an FTD device using packet tracer. Which TWO statements regarding the FTD packet tracer tool are correct? (Choose two.)

When troubleshooting FTD high memory or CPU usage, an administrator can gather diagnostic data directly from the appliance. Which THREE commands can be executed on the FTD CLI to analyze resource utilization? (Choose three.)

An administrator notices that the FMC dashboard indicates a yellow health status for an FTD device. Where should the administrator navigate to identify the specific process or service that is failing?

What is the recommended procedure for performing a major software upgrade on an FTD HA pair managed by an FMC to ensure zero downtime?

An FTD device is failing to register with the FMC. The administrator confirms connectivity via ping. Which CLI command should the administrator run on the FTD to verify the registration status and the shared secret handshake?

You are troubleshooting high CPU utilization on an FTD device. Which tool should you use to identify which specific process (e.g., snort) is consuming the most resources?

An administrator needs to perform a full system backup of the FMC. Where is the most appropriate place to store this backup for long-term disaster recovery?

When troubleshooting policy deployment failures, which log file on the FMC should be examined to see the specific error returned by the device during the commit process?

Which license state must an FTD device reach to allow the FMC to push policy configurations to it?

You are restoring an FMC backup to a new appliance. Which of the following conditions must be met for a successful restore?

Which tool in the FMC allows you to view the real-time flow of packets being processed by the Snort engine for troubleshooting purposes?

When performing a packet capture on an FTD device, how can you filter the traffic to only capture traffic from a specific source IP address?

An administrator needs to verify if an FTD is correctly receiving updates from the Cisco Support Cloud. Which menu path shows the status of rule updates and threat intelligence feeds?

When troubleshooting an issue where an FTD interface is in a 'down' state, which command helps verify if there is a physical layer issue or an administrative shutdown?

You are analyzing connection events and notice a block action. Which field in the connection event details best explains why the connection was dropped by the policy?

An administrator needs to determine if the FMC has enough disk space to hold a new software upgrade image. Which menu should they check?

When a packet capture is running on the FTD, where can you download the resulting .pcap file for analysis in Wireshark?

When troubleshooting a connectivity issue where traffic is being dropped, which TWO of the following logs or tools should be reviewed first to determine the cause?

Which action must be taken on the FTD CLI after a manual configuration change is made, if you want to ensure the FMC does not overwrite it?

Which TWO methods can be used to gather diagnostic information for a Cisco TAC case from an FTD device?

Which THREE items are included in an FMC backup archive?

When configuring FMC backup schedules, which TWO storage options are natively supported for the backup files?

Which THREE commands are valid for gathering information about the FTD's current status and health from the CLI?

When troubleshooting FTD policy deployment, which THREE of the following are common reasons for a deployment to fail?

When analyzing performance issues, which THREE metrics should an administrator monitor in the FMC Health Monitor?

Which THREE steps are part of a standard FTD upgrade workflow managed via the FMC?