Configuration

An administrator configures DNS injection and rewriting in a manual NAT rule on an FTD device. What is the primary purpose of enabling DNS translation in a NAT rule?

A network security engineer is configuring an FTD device managed by FMC to inspect traffic traversing a site-to-site VPN. The engineer wants to apply intrusion prevention and malware inspection to traffic destined to an internal web server. The traffic is already allowed by an access control rule. Which configuration step is required to ensure the traffic is inspected?

An administrator is configuring a new Cisco FTD device in FMC and needs to ensure that the device can communicate with the FMC for management and policy deployment. Which interface type must be configured on the FTD to allow FMC management?

When configuring an Access Control Policy on the FMC, what is the purpose of the Default Action set at the bottom of the rules table?

An administrator is configuring Security Intelligence feeds on the FMC. Which TWO types of objects or feeds can be used to populate Security Intelligence blacklists? (Choose two)

You need to map internal users to specific security policies based on their AD group membership. What must be configured in FMC to support this?

An administrator is deploying a new Cisco FTD device managed by FMC and needs to route traffic between two internal networks while performing NAT. The FTD must also enforce access control and inspection policies. Which interface mode must be configured on the FTD to meet these requirements?

What action should you take if you want to test a new Access Control Rule without impacting production traffic?

An engineer is configuring an Identity Policy in FMC to enforce user-based access control. Active Directory integration has been established via User Agent, but the engineer notices that some users authenticated via remote access VPN are not being resolved to their IP addresses. Which feature must be integrated into the identity configuration to capture IP-to-user mappings for remote access VPN users?

Which tab in the Access Control Policy rule editor allows you to specify the source and destination zones?

An administrator is configuring a Cisco FTD device in a high-availability pair managed by FMC. Which TWO statements about the failover link are correct? (Choose two.)

You are configuring an SSL Decryption policy. Which action is required to ensure that traffic to a specific financial website is excluded from inspection due to compliance reasons?

Which THREE methods can be used to populate IP address objects or groups in the FMC Object Management? (Choose three)

When configuring a NAT rule, which THREE options are valid 'Type' selections within the NAT Rule editor?

Where do you define the 'Search' criteria for finding objects in FMC?

When you have multiple overlapping NAT rules, which rule is applied?

A security requirement mandates that QoS be applied to limit bandwidth for guest users. Where is QoS configured on an FMC-managed FTD?

Where in the FMC UI do you go to create a new Access Control Policy?

What must be configured before an Access Control Rule can use a URL category?

What is the effect of changing the order of rules in an Access Control Policy?

What is the result of applying an 'IPS Policy' to an Access Control Rule?

What must be done to apply a change made in the Access Control Policy?

An engineer is configuring a QoS policy on an FMC-managed FTD and needs to police traffic to a maximum bandwidth limit on an interface. Which shaping/policing parameter must be configured?

What is the result of using a 'Security Group' object in an Access Control rule?

What is the primary function of the 'Object Management' section in FMC?

An administrator is configuring a new FTD device in high availability (HA) mode using FMC. The administrator must ensure that the HA failover works correctly. Which two interface types must be configured to support HA operation? (Choose two.)

When configuring a QoS policy, what happens if you exceed the 'Rate Limit' set for a traffic class?

An administrator wants to configure an Access Control rule that triggers an Intrusion Policy only when specific vulnerability signatures match. Where is the Intrusion Policy assigned?

Which TWO protocols are commonly managed via Port objects in FMC?

An administrator is configuring Security Intelligence on the FMC to drop traffic from known malicious IP addresses. Where in the Access Control Policy is Security Intelligence evaluated relative to standard access rules?

What is the purpose of an 'FQDN' object in FMC?

When defining a NAT rule for an internal server, what happens if the 'DNS Rewrite' option is enabled?

If you need to block a specific file type (e.g., .exe) from being downloaded, which feature must you enable in the Access Control Rule?

An administrator is configuring manual NAT on an FTD device managed by FMC. Which TWO parameters must be defined when creating a manual NAT rule? (Choose two)

You are configuring SSL decryption. To ensure that traffic to a specific financial domain is NOT decrypted due to privacy regulations, what must you configure in the SSL Decryption Policy?

An administrator configures an SSL Decryption Policy with a rule to 'Do Not Decrypt' financial traffic. However, the administrator also wants to ensure that the encrypted session still undergoes basic certificate validation and categorization. How does FTD handle 'Do Not Decrypt' traffic?

Which object type should be used to represent a group of network subnets?

An administrator is configuring a NAT policy on FMC for an FTD device. The requirement is to translate the source IP address of internal users to a single public IP address when accessing the Internet, while preserving the source port. Which NAT type should be used?

An administrator wants to create a Port object group containing TCP ports 80, 443, and 8080 on the FMC. Where is this object configured?

An FTD device is deployed in routed mode with multiple security zones. An administrator needs to configure an Access Control rule that evaluates traffic flowing between two different security zones. How are security zones utilized in the rule?

Which THREE settings can be configured within a Prefilter Policy on the FMC? (Choose three)

What is the purpose of 'Network Discovery' in FMC?

An FMC administrator is configuring a URL Filtering policy. They want to block URLs categorized as 'Hacking' while logging the event. Where is this configured within the Access Control Policy?

An administrator is configuring a Cisco FTD device managed by FMC to perform application control. The administrator wants to block social networking applications while allowing business applications. Which FMC configuration element should be used to identify and control these applications?

An administrator is configuring manual NAT and needs to specify an interface pair (Source Interface and Destination Interface). Why is defining interface objects important in manual NAT rules?

How do you enable 'High Availability' (HA) for an FTD pair managed by FMC?

When configuring manual NAT on an FTD device, which THREE options are available for configuring the Translated Source? (Choose three)

A network administrator is configuring an Access Control Policy on the FMC and needs to ensure that traffic from a specific subnet is inspected by the Snort engine for intrusion prevention. The administrator wants to achieve this with minimal performance impact on other traffic. Which action should be taken?

Which THREE criteria can be used to match traffic in an Access Control Policy rule?

A security engineer is creating an Access Control Policy (ACP) in FMC. The policy must block all traffic matching specific URL categories while allowing standard web browsing. However, the administrator wants users to receive a warning page before continuing to pages categorized as "Potentially Damaging Content" rather than a hard block. Which action should the engineer assign to the URL category in the ACP Rules tab?

Which TWO items must be defined to create a fully functional Network Object group in FMC?

An administrator is configuring a Network Address Translation (NAT) rule on a Cisco FMC managed Threat Defense device. The requirement is to translate the source IP address of traffic coming from the inside zone going to the outside zone, but only for a specific internal subnet. Which NAT type must the administrator select in the FMC NAT rule configuration?

An administrator wants to create a Prefilter policy to fast-path (bypass Snort inspection for) a trusted backup stream between two data centers. Which action type should be selected in the Prefilter rule?

An administrator is deploying a new Cisco FTD device in a high-availability pair managed by FMC. The security policy requires that if the primary unit fails, the secondary unit must take over immediately without dropping existing TCP sessions. Which failover configuration must the administrator verify on the FTD devices?

An administrator needs to define network objects in the FMC Object Management menu. Which THREE object types are natively supported for network definition? (Choose three)

An administrator is configuring a Prefilter Policy in FMC to optimize performance on a Cisco Firepower Threat Defense device. The requirement is to completely bypass inspection for a trusted high-speed data backup tunnel between two datacenters using GRE encapsulation. Which prefilter rule action should be selected?

An administrator is troubleshooting a Site-to-Site VPN between two FTD devices managed by FMC. The VPN tunnel is up, but traffic is not passing. The administrator suspects an issue with the crypto ACL. Which configuration element should be verified on both peers to ensure the crypto ACL matches?

An administrator is configuring an Access Control Policy on FMC and wants to log all connections that match a specific rule, including the beginning and end of each connection. Which logging action should be selected for the rule?

An administrator configures an Identity Policy on the FMC to authenticate users via Active Directory using captive portal. Where is the Identity Policy applied within the Firepower configuration hierarchy?

Which feature in FMC allows you to group multiple physical interfaces into a single logical zone for policy assignment?

When configuring an FQDN object, which THREE options are valid for the FQDN field?

A network engineer needs to configure Auto NAT on a Firepower Threat Defense device managed by FMC to translate internal subnet 10.10.10.0/24 to a single public IP address 203.0.113.50. Which translation type should be selected?

An administrator needs to create a variable set to define specific port or network variables used within Intrusion Rules. Where are variable sets managed in the FMC?

An enterprise requires FTD to decrypt outbound SSL/TLS traffic so internal users visiting external websites can be inspected by Snort for malware. Which policy and action combination must be configured?

In the context of FTD, what does 'FMC' stand for?

An administrator is configuring interface-level QoS on an FTD device. Which THREE parameters or features can be configured within an FTD QoS policy? (Choose three)

When configuring an FTD in Transparent Mode, how is the 'Bridge Group' created?

An administrator is creating an Access Control Policy rule on the FMC. Which TWO elements are required to create a basic rule? (Choose two)

When deploying a configuration change from FMC to FTD, what is the 'Deployment' process actually doing?

You are setting up an FTD interface. What is the difference between a 'Routed' and 'Transparent' interface mode?

An administrator is configuring an Identity Policy to enforce user-based access control. Which THREE identity sources are supported by the FMC for user awareness? (Choose three)

An administrator is setting up a new Cisco Firepower Threat Defense device and needs to configure platform-level parameters using FMC Platform Settings. Which TWO features can be configured via Platform Settings? (Choose two)

Which type of object is best suited for defining a web server's public-to-private NAT mapping?

An administrator is implementing an SSL Decryption Policy on a Cisco Firepower Threat Defense device managed by FMC. The policy must decrypt outbound HTTPS traffic to inspect for malware, but certain financial domains must be excluded from decryption to comply with privacy regulations. Which rule action should be configured for these specific financial domains in the SSL Decryption Policy?

An administrator is configuring an SSL Decryption Policy on the FMC. Which TWO conditions or actions can be configured within an SSL rule? (Choose two)

An Identity Policy is configured on the FMC to authenticate users connecting through the FTD. The administrator wants to use Active Directory as the identity source. Which mechanism must be configured to map user IP addresses to usernames without requiring explicit web authentication?

An FTD device is deployed behind a service provider router that performs NAT, meaning the external IP address assigned to the FTD's outside interface changes dynamically via DHCP. How should a Manual NAT rule be configured to handle outbound traffic referencing this dynamic outside IP?

An administrator is troubleshooting a Prefilter Policy configured on an FMC. Which THREE actions are available when creating a rule in a Prefilter Policy? (Choose three)

An administrator is configuring a new Access Control Policy on the Firepower Management Center and needs to add a rule that blocks peer-to-peer file sharing applications regardless of port. Which rule type should the administrator select?

Which TWO settings are available when configuring the 'Logging' tab in an Access Control Rule?

An administrator is configuring a Prefilter policy to handle GRE-encapsulated traffic. Which Prefilter rule option allows handling or accelerating tunneled traffic?

Which menu in the FMC allows you to view the list of managed FTD devices?

Which option in the Access Control Policy rule allows you to define a specific application, such as 'Facebook', to be blocked?

An administrator configures a security intelligence feed in the FMC to block known malicious IP addresses. Where are Security Intelligence feeds and lists applied in the FMC configuration?

An administrator is troubleshooting an SSL Decryption policy where encrypted connections are failing. The FMC logs indicate that clients are rejecting the FTD's re-signed certificate because it is not trusted. What configuration step is missing?

In the FMC, what is the purpose of the 'Network Discovery Policy'?

Which THREE actions can be performed by an SSL Decryption Policy?

Which THREE criteria can be used to match traffic within an Access Control rule on the FMC? (Choose three)

An administrator is configuring a Cisco FTD device managed by FMC in a high-availability pair. The administrator must ensure that failover occurs correctly. Which TWO interface configurations are required to support stateful failover? (Choose two.)

An administrator is troubleshooting an FTD device that is failing to register with FMC. The FTD has been configured with the correct FMC IP address, registration key, and NAT ID. Which additional setting must be verified on the FTD to allow successful registration?

You have a large number of NAT rules. How does the FTD process them?

An administrator wants to group multiple existing port objects (e.g., TCP 80, TCP 443, TCP 8080) into a single object for use in Access Control Policy rules. Which object container should be created?

You are defining an Access Control Policy rule to allow traffic. If you want to log the connection at the end of the flow only if it matches the rule, which Logging setting is appropriate?

How do you identify which Access Control Rule triggered a specific connection log?

You are troubleshooting a connectivity issue. The traffic is being dropped by a Prefilter rule. What is the characteristic of traffic handled by a Prefilter policy?

When editing an Access Control Rule, which action allows you to drop traffic while simultaneously sending a TCP RST to the client?

What is the result of assigning a 'Trust' action to a rule in an Access Control Policy?

An administrator needs to create a custom Application filter object in the FMC to easily select cloud storage applications in Access Control rules. Where are application filters created?

What occurs when an 'Interactive Block' action is used in an Access Control rule?

An administrator needs to configure Quality of Service (QoS) on a Cisco Firepower Threat Defense device via FMC to limit peer-to-peer traffic bandwidth. Where must the QoS policy be applied for it to take effect on traffic traversing the firewall?

An administrator is configuring SSL Decryption to inspect internal clients browsing external websites. The organization wants to ensure that traffic to financial and health-related websites is bypassed to maintain privacy and regulatory compliance. How should this be configured in the SSL Policy?

An administrator wants to ensure that specific internal subnets are never subjected to NAT translation when communicating with a partner VPN tunnel. Which NAT feature achieves this?

Which THREE components of an Access Control rule can be used to identify traffic as 'Application' based?

You are creating a custom URL category. How do you add specific domains to this category in FMC?

An engineer wants to group several FTD interfaces into a single logical zone to simplify Access Control rule creation. Where are security zones created in the FMC?

You are configuring a NAT rule and need to hide the internal network behind a single interface IP. Which NAT translation setting is required?

What is the primary function of a 'Security Zone' in FMC?

Which TWO components must be configured in FMC to enable User Identity mapping for Access Control Rules?