CCNA Configuration Questions

An administrator configures DNS injection and rewriting in a manual NAT rule on an FTD device. What is the primary purpose of enabling DNS translation in a NAT rule?

An administrator is configuring Manual NAT on an FTD device. Which THREE parameters must be defined when creating a Manual Static NAT rule for inbound traffic? (Choose three)

When using the 'Search' feature in the Access Control Policy, which filter allows you to find all rules containing a specific network object?

When configuring an Access Control Policy on the FMC, what is the purpose of the Default Action set at the bottom of the rules table?

An administrator is configuring Security Intelligence feeds on the FMC. Which TWO types of objects or feeds can be used to populate Security Intelligence blacklists? (Choose two)

You need to map internal users to specific security policies based on their AD group membership. What must be configured in FMC to support this?

What action should you take if you want to test a new Access Control Rule without impacting production traffic?

An engineer is configuring an Identity Policy in FMC to enforce user-based access control. Active Directory integration has been established via User Agent, but the engineer notices that some users authenticated via remote access VPN are not being resolved to their IP addresses. Which feature must be integrated into the identity configuration to capture IP-to-user mappings for remote access VPN users?

Which tab in the Access Control Policy rule editor allows you to specify the source and destination zones?

You are configuring an SSL Decryption policy. Which action is required to ensure that traffic to a specific financial website is excluded from inspection due to compliance reasons?

An administrator is configuring Security Intelligence in FMC. Which TWO types of objects can be added to Security Intelligence blacklists or whitelists? (Choose two)

Which THREE methods can be used to populate IP address objects or groups in the FMC Object Management? (Choose three)

When configuring a NAT rule, which THREE options are valid 'Type' selections within the NAT Rule editor?

Where do you define the 'Search' criteria for finding objects in FMC?

When you have multiple overlapping NAT rules, which rule is applied?

A security requirement mandates that QoS be applied to limit bandwidth for guest users. Where is QoS configured on an FMC-managed FTD?

Where in the FMC UI do you go to create a new Access Control Policy?

What must be configured before an Access Control Rule can use a URL category?

What is the effect of changing the order of rules in an Access Control Policy?

What is the result of applying an 'IPS Policy' to an Access Control Rule?

An administrator needs to configure an identity policy to authenticate users using an external RADIUS server via Passive Authentication. Which mechanism accomplishes passive user identification?

What must be done to apply a change made in the Access Control Policy?

An engineer is configuring a QoS policy on an FMC-managed FTD and needs to police traffic to a maximum bandwidth limit on an interface. Which shaping/policing parameter must be configured?

What is the result of using a 'Security Group' object in an Access Control rule?

What is the primary function of the 'Object Management' section in FMC?

When creating a network object in FMC, which field allows you to define a group of IP addresses using CIDR notation?

Which tab in the FMC Object Manager allows you to manage pre-defined objects?

You are configuring a NAT rule on an FTD device managed by FMC. You need to translate the source IP of internal hosts to a specific public IP address when they access the internet. Which NAT type must be selected in the FMC NAT Rule editor?

When configuring a QoS policy, what happens if you exceed the 'Rate Limit' set for a traffic class?

Which TWO methods can be used to identify users in an Identity Policy?

An administrator wants to configure an Access Control rule that triggers an Intrusion Policy only when specific vulnerability signatures match. Where is the Intrusion Policy assigned?

Which TWO protocols are commonly managed via Port objects in FMC?

An administrator needs to create a custom URL object to block a specific malicious domain name 'example.malicious.com' in an Access Control Policy. Which object type should be created?

An administrator is configuring Security Intelligence on the FMC to drop traffic from known malicious IP addresses. Where in the Access Control Policy is Security Intelligence evaluated relative to standard access rules?

What is the purpose of an 'FQDN' object in FMC?

When defining a NAT rule for an internal server, what happens if the 'DNS Rewrite' option is enabled?

If you need to block a specific file type (e.g., .exe) from being downloaded, which feature must you enable in the Access Control Rule?

An administrator is configuring manual NAT on an FTD device managed by FMC. Which TWO parameters must be defined when creating a manual NAT rule? (Choose two)

You are configuring SSL decryption. To ensure that traffic to a specific financial domain is NOT decrypted due to privacy regulations, what must you configure in the SSL Decryption Policy?

Which THREE actions can be assigned to an individual rule within an Access Control Policy on the FMC? (Choose three)

An administrator configures an SSL Decryption Policy with a rule to 'Do Not Decrypt' financial traffic. However, the administrator also wants to ensure that the encrypted session still undergoes basic certificate validation and categorization. How does FTD handle 'Do Not Decrypt' traffic?

An administrator needs to configure manual NAT on an FTD device to translate both the source IP and source port of outbound packets originating from 192.168.2.50 to a specific public IP 198.51.100.10 and port 50000. Which manual NAT rule element achieves this?

A network engineer is deploying a Firepower Threat Defense (FTD) device and must configure NAT to translate an internal server IP of 10.10.10.50 to a public IP of 203.0.113.50 while preserving the original source port for inbound traffic. Which NAT type accomplishes this?

Which object type should be used to represent a group of network subnets?

An administrator wants to create a Port object group containing TCP ports 80, 443, and 8080 on the FMC. Where is this object configured?

Which TWO fields are commonly used in the 'NAT Rule' editor to define the source address?

An FTD device is deployed in routed mode with multiple security zones. An administrator needs to configure an Access Control rule that evaluates traffic flowing between two different security zones. How are security zones utilized in the rule?

Which THREE settings can be configured within a Prefilter Policy on the FMC? (Choose three)

What is the purpose of 'Network Discovery' in FMC?

An FMC administrator is configuring a URL Filtering policy. They want to block URLs categorized as 'Hacking' while logging the event. Where is this configured within the Access Control Policy?

You are configuring a NAT rule for a web server located in a DMZ. You want to translate the destination IP from a public address to the private DMZ address. Which NAT type is used?

An administrator is configuring manual NAT and needs to specify an interface pair (Source Interface and Destination Interface). Why is defining interface objects important in manual NAT rules?

How do you enable 'High Availability' (HA) for an FTD pair managed by FMC?

An administrator is configuring Access Control Policy rules on the FMC. The default action for unmatched traffic is currently set to Block. The requirement is changed so that unmatched traffic should pass through the FTD without inspection. Where is this setting modified?

When configuring manual NAT on an FTD device, which THREE options are available for configuring the Translated Source? (Choose three)

Which THREE criteria can be used to match traffic in an Access Control Policy rule?

A security engineer is creating an Access Control Policy (ACP) in FMC. The policy must block all traffic matching specific URL categories while allowing standard web browsing. However, the administrator wants users to receive a warning page before continuing to pages categorized as "Potentially Damaging Content" rather than a hard block. Which action should the engineer assign to the URL category in the ACP Rules tab?

Which TWO items must be defined to create a fully functional Network Object group in FMC?

An administrator is configuring a Network Address Translation (NAT) rule on a Cisco FMC managed Threat Defense device. The requirement is to translate the source IP address of traffic coming from the inside zone going to the outside zone, but only for a specific internal subnet. Which NAT type must the administrator select in the FMC NAT rule configuration?

An administrator wants to create a Prefilter policy to fast-path (bypass Snort inspection for) a trusted backup stream between two data centers. Which action type should be selected in the Prefilter rule?

An administrator needs to define network objects in the FMC Object Management menu. Which THREE object types are natively supported for network definition? (Choose three)

An administrator configures an SSL Decryption Policy on the FMC to decrypt inbound HTTPS traffic destined for an internal web server. The administrator imports the private key and server certificate into the FMC. Which decryption action must be selected to allow the FTD to decrypt this traffic using the server's private key?

An administrator is configuring a Manual NAT rule in the FMC for an internal server that needs to be accessed from the outside zone. The internal IP is 192.168.1.50, and it must be translated to a public IP 203.0.113.10. Which TWO configuration parameters must be specified when defining this Manual NAT rule? (Choose two)

An administrator is configuring a Prefilter Policy in FMC to optimize performance on a Cisco Firepower Threat Defense device. The requirement is to completely bypass inspection for a trusted high-speed data backup tunnel between two datacenters using GRE encapsulation. Which prefilter rule action should be selected?

An administrator needs to configure Active Authentication using a captive portal on an FTD device. Which firewall feature must be properly configured and running to present the authentication prompt to users?

An administrator wants to decrypt inbound HTTPS traffic destined for a public web server behind a Firepower Threat Defense device. Which type of SSL/TLS decryption policy must be configured on the FMC?

An administrator configures an Identity Policy on the FMC to authenticate users via Active Directory using captive portal. Where is the Identity Policy applied within the Firepower configuration hierarchy?

Which feature in FMC allows you to group multiple physical interfaces into a single logical zone for policy assignment?

When configuring an FQDN object, which THREE options are valid for the FQDN field?

A network engineer needs to configure Auto NAT on a Firepower Threat Defense device managed by FMC to translate internal subnet 10.10.10.0/24 to a single public IP address 203.0.113.50. Which translation type should be selected?

An administrator needs to create a variable set to define specific port or network variables used within Intrusion Rules. Where are variable sets managed in the FMC?

An enterprise requires FTD to decrypt outbound SSL/TLS traffic so internal users visiting external websites can be inspected by Snort for malware. Which policy and action combination must be configured?

In the context of FTD, what does 'FMC' stand for?

Which TWO tasks are required to delete a NAT rule safely?

An administrator needs to ensure that internal users can access the internet using a public IP while hiding their private address. Which NAT rule type should be configured on the FMC?