CCNA Configuration Questions

DNS translation rewrites A-record payloads inside DNS replies, so an external client querying an internal server's hostname receives the mapped public NAT address rather than the unreachable private IP. This satisfies the stem's requirement that DNS injection and rewriting accompany the manual NAT rule, keeping name resolution consistent with address translation.

Within an access control rule, the Inspection tab allows you to select intrusion and malware policies. Enabling these options ensures that matching traffic is inspected by the chosen IPS and malware policies. This is the standard method to apply deep inspection in FTD access control.

The management interface on an FTD device is used for out-of-band management, including communication with FMC for policy deployment, logging, and health monitoring. It must be configured with an IP address, gateway, and DNS settings. Without a properly configured management interface, the FTD cannot register with FMC or receive policies.

The Default Action is the terminal rule applied when no earlier rule matches the packet, ensuring every connection receives a definitive verdict rather than being dropped implicitly. It satisfies the requirement that unmatched traffic still be handled by an explicit allow, block, or monitor decision.

Custom Network/IP Lists are administrator-defined objects holding specific addresses or ranges, uploaded directly to the FMC. They populate Security Intelligence blacklists without relying on external reputation services, satisfying the requirement for locally controlled, static blocklists in this scenario.

An Identity Policy in FMC binds users to realm and group attributes, then maps those identities to specific access control policies. Group membership from Active Directory therefore determines which security policy each internal user receives.

Routed mode allows the FTD to act as a Layer 3 device, performing routing, NAT, and policy enforcement between networks. It is the standard mode for inter-network traffic that requires IP address translation and access control, making it the correct choice for this scenario.

The Monitor action logs and evaluates traffic against the rule without blocking it, so you can observe what the rule would have denied while production traffic continues unaffected. This satisfies the requirement to test the Access Control Rule without impacting production.

Cisco ISE supplies IP-to-user mappings for remote access VPN sessions through RADIUS Accounting and pxGrid, which the User Agent alone cannot capture because it only passively monitors Active Directory logins. Integrating ISE satisfies the requirement to resolve VPN users' identities, enabling the Identity Policy to enforce user-based access control.

The Zones tab defines source and destination security zones for traffic matching the rule, satisfying the requirement to scope the policy by zone. Zones map interfaces to trust levels, so specifying them here controls which network segments the rule inspects, unlike Applications or Ports tabs which filter by service and protocol.

The failover link carries state and health information between HA peers. It can be a dedicated physical interface or a VLAN subinterface on an existing data interface. This separation ensures that failover traffic does not compete with data traffic and is isolated for reliability. Using a dedicated link or VLAN is a requirement for proper HA operation.

This allows the traffic to pass through the firewall without SSL inspection.

A CIDR network object accepts an address plus prefix length, defining an entire subnet such as 10.10.0.0/24 in one entry. This satisfies the stem's requirement for populating FMC objects, since CIDR notation efficiently represents whole networks rather than listing individual host addresses.

Static NAT is one of the three Type values offered by the NAT Rule editor, giving a fixed one-to-one mapping between an original and translated address. It satisfies the stem because the editor presents it as a selectable rule type, not a separate policy setting.

Correct, this page has the search functionality.

Cisco Secure Firewall evaluates NAT rules sequentially and applies the first rule whose match criteria the traffic satisfies, then stops processing further NAT rules. Rule order therefore determines the outcome, so overlapping rules must be arranged with the most specific entries placed above broader ones.

QoS on FTD is applied through a dedicated QoS Policy, separate from access control and other policy types. Creating one and attaching it to the relevant access control policy lets you rate-limit guest traffic, satisfying the bandwidth restriction the requirement demands.

Access Control Policies are created and managed under the Policies menu in the FMC UI, where the Access Control sub-item lists existing policies and offers the New Policy action. This path satisfies the requirement to create a new policy rather than edit an existing one.

URL categories are populated by the URL filtering database, which requires a valid URL Filtering licence to be installed and active on the firewall. Without that licence, category-based matching is unavailable, so the Access Control Rule cannot reference URL categories as match criteria.

Access Control Policies are processed top-down, first-match-wins, so reordering rules alters which rule matches a given packet first. Moving a permit above a deny, or vice versa, therefore changes the evaluation sequence and the resulting action.

Applying an IPS policy to an Access Control Rule activates the intrusion prevention engine on traffic matching that rule, enabling deep packet inspection of the permitted flows. The policy inspects packet payloads against signatures and blocks malicious activity inline, satisfying the requirement to detect and prevent exploits within allowed connections.

Changes to the Access Control Policy remain in a draft state until committed to the managed devices. Clicking Deploy pushes the edited policy to the firewalls, so the new rules take effect; saving alone leaves the previous policy running.

Traffic policing enforces a maximum bandwidth by dropping or marking excess packets, and requires a Committed Information Rate defining the allowed average rate. This satisfies the stem's requirement to cap traffic at a maximum bandwidth limit on the interface.

A Security Group object references a Security Group Tag, so the rule matches traffic by the SGT value carried in the packet rather than by IP address, subnet, or interface. This satisfies the requirement to enforce policy based on SGT.

Object Management in FMC stores reusable definitions such as network, port, URL and geolocation objects, which policies then reference. This satisfies the requirement to create reusable objects rather than duplicating values across access control rules.

In FTD HA, a dedicated failover link is required to exchange heartbeat and state information between the active and standby units. This link must be configured on both devices and cannot be used for regular data traffic. It ensures rapid detection of failures and coordination of failover events.

Exceeding a QoS policy's Rate Limit causes the policer to drop or remark excess packets beyond the committed rate, keeping traffic within the configured class limit. Policing, rather than shaping or queuing, is the action applied to out-of-profile traffic.

An Intrusion Policy is bound to a specific Access Control rule via its Inspection tab, so the policy is evaluated only for traffic matching that rule's conditions. This scopes intrusion detection to the vulnerability signatures the administrator wants.

UDP is a transport-layer protocol identified by port numbers, so FMC represents it as a Port object for use in access control rules. Port objects pair the protocol with the relevant port or range when defining policy.

Security Intelligence uses reputation and category-based blocking lists evaluated before the access control rules, so malicious IP traffic is dropped without reaching rule matching. This ordering satisfies the stem's requirement, since blacklisted sources never consume rule processing or reach later allow decisions.

An FQDN object resolves a fully qualified domain name to its IP addresses, so access control rules can reference a hostname rather than hard-coded addresses. This satisfies the requirement to define a domain name, letting policies survive DNS changes without rule rewrites.

Correct, it rewrites the A-record to the internal IP.

File Policy is the Access Control Rule setting that inspects file attributes such as type or reputation, enabling blocking of specific extensions like .exe. Without it enabled, the rule cannot evaluate file characteristics for download decisions.

Original Source identifies the real internal host or subnet whose traffic is translated, forming the match criterion for the manual NAT rule. It satisfies the mandatory parameter requirement because FMC needs this object to determine which packets the translation applies to.

An SSL rule matching the financial domain with the 'Do Not Decrypt' action exempts that traffic from decryption, satisfying the privacy regulation constraint. The rule is evaluated before decryption rules, so matching sessions pass through encrypted.

Extracting the SNI from the unencrypted Client Hello lets FTD categorise the session without decrypting payload, satisfying the 'Do Not Decrypt' rule while still applying URL filtering. Certificate validation, however, is not performed on this traffic, so the stem's validation requirement is only partly met.

A Network Group object in Cisco Secure Firewall Management Center represents a collection of network subnets, satisfying the requirement to group subnets as a single reusable object. Unlike individual host or range objects, it aggregates multiple subnet entries, letting policies reference them collectively rather than listing each subnet separately.

Dynamic PAT, also known as NAT overload, translates multiple internal IP addresses to a single public IP address while using unique source ports to distinguish sessions. This meets the requirement of using one public IP and preserving the source port (by translating it to a unique port). It is the correct choice for allowing many internal users to share one public IP.

Port object groups are created under Objects > Object Management > Ports in the FMC, where individual TCP and UDP ports are defined and grouped. This location satisfies the requirement to build a group containing TCP ports 80, 443 and 8080.

Within an Access Control rule, security zones are chosen on the Zones tab, specifying which source and destination zones the rule matches. This lets the administrator evaluate traffic flowing between two different zones, satisfying the inter-zone inspection requirement.

FastPath is a prefilter action that bypasses Snort inspection entirely for matching traffic, offloading it from the detection engine. This differs from access control rules, which pass traffic through Snort; FastPath is unique to the prefilter layer.

Network Discovery passively maps hosts, operating systems, and user activity by analysing traffic mirrored from managed devices, satisfying the requirement to identify endpoints and associated users without inline inspection. It populates the network map and host profiles used for access control and event correlation, distinguishing it from active scanning or policy enforcement functions.

The URLs tab within an Access Control rule holds URL Filtering settings, where you select categories such as Hacking and set the action to Block with logging enabled. This satisfies the requirement to block and log within the existing Access Control Policy, rather than a separate policy type.

The Application Filter is used within an Access Control rule to identify applications and application categories. By selecting the social networking category and setting the action to Block, the administrator can block those applications while allowing business applications. This is the correct method for application control in FTD.

Interface objects bind the NAT rule to a defined source and destination interface pair, so translation applies only to traffic traversing that path. This scoping prevents the rule from matching unrelated traffic on other interfaces, satisfying the stem's requirement to constrain translation.

HA is a device-level configuration.

Manual NAT permits the translated source to be a specific host or network object, giving one-to-one or many-to-one translation to a defined address. This satisfies the stem's requirement by naming a concrete translated source type available in FTD's manual NAT configuration.

Setting the action to Allow with Intrusion Prevention enabled ensures that only traffic matching the rule is inspected by Snort. Other traffic that does not match this rule will be handled by subsequent rules, potentially with different inspection levels. This minimizes performance impact because only the specified subnet's traffic undergoes deep inspection. This is the correct approach to selectively apply IPS.

Application criteria match traffic by identifying the specific application or application category, using Cisco's Next-Generation Firewall application detectors rather than port alone. This satisfies the stem's requirement for a match criterion in an Access Control Policy rule, letting you enforce policy on evasive applications that hop ports or use encryption.

Interactive Block presents a warning page requiring the user to acknowledge and continue, satisfying the stem's requirement for a warning rather than a hard block. Block would deny outright; Allow would permit silently. This action matches the "Potentially Damaging Content" category behaviour requested.

A network object group must contain at least one member object, such as a host, network, or range, since the group exists solely to bundle them for policy reuse. An empty group is functionally useless, making member objects the second mandatory element.

Auto NAT, or object NAT, is defined on a single network object, here the internal subnet, and translates only that object's source address between the chosen interfaces or zones. For outbound internet access it is usually dynamic PAT to the outside interface address. It is the simplest and recommended way to do ordinary source NAT, while manual NAT is reserved for translations that depend on the destination or need precise ordering.

FastPath bypasses Snort inspection entirely for matching traffic, satisfying the requirement to fast-path the trusted backup stream. Access Control rules instead block or allow with inspection, so FastPath is the only action that skips intrusion analysis while permitting the flow between data centres.

Stateful failover replicates connection state and inspection tables between the active and standby units, so established TCP sessions continue without re-establishment when failover occurs. The failover link must be a dedicated interface or the same interface with a separate VLAN. Without stateful failover, the standby unit would drop existing sessions because it lacks the state information.

A Host Object stores a single IPv4 or IPv6 address as a named, reusable entity in FMC Object Management. It satisfies the stem's network-definition requirement because hosts are one of the native network object types, referenceable directly in access control and NAT rules.

Fast Path bypasses further inspection of the tunnel while still applying prefilter rules, matching the requirement to completely skip inspection for trusted GRE backup traffic. It differs from Trust, which passes traffic to the snort inspection engine, so Fast Path delivers the needed performance.

The crypto ACL in a policy-based VPN defines the interesting traffic that is encrypted and sent through the tunnel. On FTD managed by FMC, the protected networks are configured in the VPN topology and must match on both peers. If they do not match, traffic will not be encrypted or decrypted correctly, causing the tunnel to drop traffic.

This option generates a connection event at the start and another at the end of each connection, providing full visibility. It is useful for detailed analysis and compliance. The other options do not provide both start and end logging, which is required to capture the entire connection lifecycle.

Identity policies are bound to access control policies on the FMC; the ACP then applies them to matching traffic. The captive portal authentication and Active Directory realm selection therefore take effect only through that access control policy association, not at the device or platform level.

A Security Zone groups multiple physical interfaces into one logical unit, letting you assign and reuse policy against that zone rather than per interface. This satisfies the stem's requirement for grouping interfaces for policy assignment within FMC.

A subdomain entry lets the FQDN object match hosts beneath a parent domain, such as mail.example.com, which the FQDN field accepts as a valid value alongside single domain names and wildcards. This satisfies the question's requirement for a valid FQDN field option.

Dynamic PAT translates many internal addresses to one public IP using unique source ports, matching the /24-to-single-address requirement. Static NAT would need one public address per host, and dynamic NAT without PAT requires a pool.

Variable sets are managed under Objects > Object Management > Variable Sets in the FMC, where port, network and other variables used by intrusion rules are defined and later applied via intrusion policies. This is the dedicated location for creating and editing those reusable rule variables.

Outbound inspection requires the firewall to intercept the TLS session, so a Decrypt - Resign action re-signs traffic with an internal CA certificate, letting Snort inspect plaintext. Decrypt - Pass Through would leave traffic encrypted and invisible to Snort, failing the malware inspection requirement.

FMC is the centralised management appliance for Cisco Firepower deployments, providing policy configuration, event correlation and device management for managed FTD sensors. It is distinct from the FTD device itself, which enforces the policies pushed from the FMC.

The FTD QoS policy marks egress traffic by rewriting the DSCP field in packet headers, letting downstream devices classify and treat flows according to the assigned per-hop behaviour, which is the marking capability the interface-level policy exposes.

In FTD transparent mode, the bridge group is defined under Device Management > Interfaces, where you assign the member interfaces and bridge group ID. This binds the paired interfaces into a single Layer 2 forwarding domain.

Every access control rule requires a unique name to identify and order it within the policy; the FMC will not save a rule without one. This satisfies the stem's requirement for a mandatory element when creating a basic rule.

Deployment pushes the pending policy and configuration changes from FMC down to the managed FTD devices, applying them to the running configuration. It does not merely validate syntax or back up settings; the task is propagating edited access control and related policies to enforcement points.

Transparent mode forwards frames at Layer 2, acting as a bump-in-the-wire bridge without IP addressing on its data interfaces. Routed mode performs Layer 3 forwarding between distinct subnets. Choosing transparent satisfies the stem's requirement to compare the two modes by their differing OSI layer of operation.

RADIUS accounting supplies user-to-IP mappings to the FMC, letting identity policies enforce user-based access control without an agent. The FMC passively consumes accounting start and stop records to build its user awareness table, satisfying the scenario's requirement for a supported identity source.

SNMP parameters are platform-level settings configured per FTD device via FMC Platform Settings, covering polling hosts, traps and community strings. This satisfies the stem's requirement for platform-level parameters rather than access-control or intrusion policy configuration, which sit elsewhere in FMC.

A host network object represents a single IP address, letting you define a static one-to-one mapping between one public address and one private address. That precisely matches a web server's public-to-private NAT requirement, unlike subnet or range objects.

Do Not Decrypt exempts matching traffic from TLS inspection, so financial domains pass through encrypted and unexamined. This satisfies the privacy regulation requiring those sessions remain private while outbound HTTPS elsewhere is still decrypted for malware inspection.

URL Categories are a standard condition within SSL rules, letting the administrator selectively decrypt or bypass traffic to sites such as Banking or Gambling. This satisfies the stem's requirement for a configurable condition, since category-based matching is supported directly in the SSL Decryption Policy rule criteria.