Courseiva

CCNA Deployment Questions

75 of 150 questions · Page 1/2 · Deployment · Answers revealed

Practice these questionsDomain overviewAll questions
1
MCQeasy

You are deploying a Cisco Secure Firewall Threat Defense in transparent mode. How are frames forwarded between the internal and external interfaces of the firewall?

A.By encapsulating all packets inside GRE tunnels between the ingress and egress ports.
B.By bridging frames at Layer 2 based on destination MAC addresses within a configured Bridge Group.
C.By translating all private IP addresses to public IP addresses using NAT overload.
D.By performing IP route lookups and decrementing the TTL on every packet.
AnswerB

Transparent firewalls use Layer 2 bridging, forwarding frames based on MAC addresses across bridge groups.

Why this answer

Transparent mode bridges traffic at Layer 2 using Bridge Groups and Bridge Virtual Interfaces (BVIs), forwarding frames based on destination MAC addresses rather than Layer 3 routing.

Practice this question →
2
Multi-Selectmedium

Which TWO statements are true regarding NGIPS passive mode deployment?

Select 2 answers
A.It requires an inline bypass switch.
B.It is transparent to the network traffic path.
C.It is connected to a SPAN or TAP port.
D.It can actively reset connections.
E.It requires dual-homed physical interfaces.
AnswersB, C

Since it is out-of-band, it does not impact traffic.

Why this answer

Passive mode is for monitoring only and connects to a span/tap port, thus it cannot affect traffic flow.

Practice this question →
3
MCQmedium

An engineer is deploying a Cisco Secure Firewall Threat Defense in routed mode and must configure an internal interface connected to a data center segment. The requirement is to route traffic at Layer 3 while keeping the firewall transparent to the MAC addresses of the hosts. Which action should the engineer perform on the interface setting in Cisco FMC?

A.Set the operational mode of the interface to inline set for passive inspection without MAC rewriting.
B.Configure the interface as a BVI member to bridge the traffic across the subnet.
C.Enable the passive tap option on the physical port to monitor the data center segment out-of-band.
D.Configure the interface as a routed interface with an IP address, relying on standard Layer 3 routing.
AnswerD

A routed interface operates at Layer 3, terminating the subnet and routing traffic while updating the source and destination MAC addresses.

Why this answer

In routed mode, the firewall acts as a Layer 3 device and routes traffic using IP addresses while rewriting MAC addresses. Transparent mode operates at Layer 2. To operate at Layer 3 in routed mode while avoiding Layer 2 transparent bridge groups, standard routed interface configuration is used.

Practice this question →
4
Multi-Selecthard

An engineer is preparing to deploy a Cisco Secure Firewall Threat Defense cluster in an enterprise data center. Which THREE requirements must be verified and configured prior to cluster initialization? (Choose three)

Select 3 answers
A.A dedicated high-speed, low-latency Cluster Control Link (CCL) must be connected between all nodes.
B.All cluster members must be of the exact same physical or virtual model with identical interface counts.
C.The cluster master must be configured in transparent mode while slave nodes operate in routed mode.
D.Each cluster member must run a different software version to prevent simultaneous kernel panics.
E.Data interfaces on all cluster units must be connected to upstream/downstream switches using Port Channels.
AnswersA, B, E

CCL connectivity is mandatory for cluster control synchronization.

Why this answer

Firewall clustering requirements include identical hardware models/licenses, dedicated Cluster Control Link (CCL) connections, and Port Channels connecting upstream/downstream switches to all cluster nodes.

Practice this question →
5
MCQeasy

When deploying an FTD virtual appliance on-prem using VMware ESXi, which virtual network adapter type is recommended for optimal performance?

A.E1000
B.E1000E
C.SR-IOV
D.VMXNET3
AnswerD

VMXNET3 is the recommended driver for high-throughput network applications.

Why this answer

VMXNET3 is the high-performance paravirtualized network adapter recommended for all Cisco virtual appliances on VMware to reduce CPU overhead.

Practice this question →
6
MCQhard

An engineer is configuring a Cisco Secure Firewall Threat Defense cluster in a data center. To ensure high availability and prevent split-brain scenarios, what is the specific function of the cluster control link (CCL)?

A.It serves as the dedicated data forwarding path for all east-west traffic between different subnets.
B.It synchronizes configuration, connection state tables, and heartbeat health checks between cluster members.
C.It offloads all Snort inspection processing from data nodes to the control node.
D.It connects the cluster directly to the Cisco FMC management cloud over an encrypted TLS tunnel.
AnswerB

The CCL handles inter-node communication, including state synchronization, configuration sync, and health monitoring.

Why this answer

The Cluster Control Link (CCL) is dedicated to synchronization, health monitoring, and control messaging between cluster nodes, preventing split-brain conditions by maintaining quorum and state sync.

Practice this question →
7
MCQeasy

An administrator is planning the deployment of a Cisco Secure Firewall Threat Defense device and needs to choose between routed mode and transparent mode. Which factor strongly favors choosing transparent mode?

A.The network requires advanced NAT, PAT, and dynamic routing protocols like OSPF and BGP.
B.The firewall needs to be inserted into an existing IP subnet without altering current gateway or routing designs.
C.The deployment requires termination of site-to-site IPsec VPN tunnels.
D.The firewall must act as the default gateway for multiple VLAN segments.
AnswerB

Transparent mode acts as a stealth bridge, allowing insertion without redesigning network IP schemas.

Why this answer

Transparent mode is typically chosen when inserting a firewall into an existing IP address scheme without wanting to redesign the subnetting or routing architecture.

Practice this question →
8
Multi-Selecthard

Which THREE interface types are supported on FTD appliances?

Select 3 answers
A.Port channel interfaces.
B.Bridge-only interfaces.
C.Virtual-router interfaces.
D.Physical interfaces.
E.Sub-interfaces.
AnswersA, D, E

Used for link aggregation.

Why this answer

Physical interfaces, sub-interfaces, and port channel interfaces are standard configurations on Cisco FTD.

Practice this question →
9
MCQmedium

An FTD device is configured in routed mode. What must be configured to allow traffic to exit the network through the firewall?

A.An inline bypass pair.
B.A bridge group interface.
C.A passive monitoring interface.
D.A static route pointing to the gateway.
AnswerD

Static routing is required for L3 forwarding in routed mode.

Why this answer

In routed mode, the FTD acts as a router; therefore, an upstream default route or specific static routes are required to forward traffic to the next hop.

Practice this question →
10
MCQmedium

You are configuring a high availability pair of FTDs. Which interface type is strictly reserved for state synchronization?

A.Management interface
B.Data interface
C.Dedicated Failover/State link
D.Diagnostic interface
AnswerC

This link is required for stateful failover synchronization.

Why this answer

The failover link (specifically the dedicated state link) is used to synchronize connection state, NAT tables, and other session data between the active and standby units.

Practice this question →
11
MCQmedium

You are deploying a Cisco Secure Firewall in transparent mode. Which requirement must be met to ensure the appliance can successfully pass traffic between two directly connected subnets?

A.Define a Bridge Group and assign interfaces to it, ensuring the device is in Layer 2 mode.
B.Configure the firewall as the default gateway for the subnets.
C.Enable dynamic routing protocols on the bridge interface.
D.Configure an IP address on each physical interface participating in the bridge group.
AnswerA

Transparent mode requires a Bridge Group to map interfaces together at Layer 2.

Why this answer

In transparent mode, the firewall acts as a Layer 2 device. It requires a management IP address for communication but does not route traffic. It processes traffic based on L2 segments.

Practice this question →
12
MCQmedium

You need to configure link redundancy on a Cisco Secure Firewall Threat Defense pair using EtherChannel (Port Channel) across multiple physical interfaces. When configuring LACP (IEEE 802.3ad) for the port channel interface via the Firepower Management Center (FMC), which requirement must be met for successful negotiation?

A.The Port Channel must be configured in static mode (ON) regardless of the upstream switch settings to avoid LACP PDUs dropping.
B.Both the FTD and the connected switch must be configured in LACP active mode or one must be active and the other passive.
C.The EtherChannel must use Source-Destination IP hashing exclusively, as MAC-based hashing is unsupported on FTD.
D.LACP fast rate (1-second timer) is mandatory for FTD clustering but optional for standalone firewalls.
AnswerB

LACP requires at least one end of the channel to be in active mode to initiate and successfully establish the bundle.

Why this answer

When configuring LACP on FTD, the mode must match the upstream/downstream switch configuration (Active/Active or Active/Passive) and physical parameters like speed and duplex must match identically.

Practice this question →
13
Multi-Selecthard

An engineer is designing a high-availability architecture utilizing Equal-Cost Multi-Path (ECMP) routing with Cisco Secure Firewall Threat Defense units. Which THREE characteristics or limitations apply to ECMP on FTD? (Choose three)

Select 3 answers
A.ECMP is restricted exclusively to transparent firewall deployments and cannot be used in routed mode.
B.ECMP distributes traffic across multiple equal-cost next-hop routes to optimize bandwidth utilization and path redundancy.
C.ECMP automatically synchronizes state tables between independent firewall appliances without requiring an HA control link.
D.Traffic flow hashing algorithms are used to ensure packets belonging to the same TCP/UDP session take the same path.
E.ECMP can be populated via dynamic routing protocols such as OSPF and BGP, or via static routes with equal metrics.
AnswersB, D, E

ECMP load balances traffic across multiple equal-cost paths.

Why this answer

ECMP on FTD balances traffic across multiple paths, requires dynamic routing protocols like OSPF/BGP or static routes, and hashes flows based on packet headers.

Practice this question →
14
MCQeasy

Which interface configuration is required to allow traffic to pass between two interfaces that belong to the same bridge group?

A.A static route to the BVI.
B.A VLAN trunk configuration.
C.A bridge group interface (BVI) with an IP address.
D.An IP address on both interfaces.
AnswerC

The BVI acts as the logical L3 entity for the bridge group.

Why this answer

Bridge group members are treated as segments of the same L2 domain, allowing traffic to pass without routing.

Practice this question →
15
MCQmedium

Which component is responsible for processing traffic in an FTD cluster when 'Distributed' mode is used?

A.All cluster members.
B.The management node.
C.A separate load-balancing virtual machine.
D.Only the primary node.
AnswerA

Distributed mode utilizes all nodes for processing.

Why this answer

In distributed mode, traffic is load-balanced across all members of the cluster, and each node processes its own traffic flows.

Practice this question →
16
MCQhard

An administrator is troubleshooting an active/standby Cisco Secure Firewall High Availability pair. Stateful failover is enabled, but active long-lived TCP connections are dropping when a failover occurs. Upon checking the stateful inspection settings, what is the most likely cause of this behavior?

A.The units are running different minor patch versions of Cisco FTD, causing the state payload to be silently dropped by the receiver.
B.The stateful failover link (FMC control link) is using a management-only interface instead of a dedicated high-speed data interface.
C.Dynamic NAT translation entries are not being synchronized across the failover link because stateful NAT translation sync is disabled.
D.The active unit is configured with stateful failover, but the standby unit is configured for stateless failover via CLI.
AnswerC

Without stateful NAT sync, NAT mappings are lost on the standby unit, causing active translated TCP streams to fail upon failover.

Why this answer

If 'Stateful Inspection' or the specific protocol inspection is disabled or not synchronized, or if the asymmetric routing path prevents state synchronization, long-lived connections will drop. Specifically, if the TCP state bypass feature or asynchronous state settings are misconfigured, state tables will not match.

Practice this question →
17
MCQhard

When configuring an FTD cluster, what is the purpose of the Control Plane IP address?

A.To synchronize the configuration files across the cluster.
B.To handle user authentication traffic.
C.To allow the FMC to manage the cluster as a single logical device.
D.To serve as the default gateway for internal hosts.
AnswerC

Control Plane IPs enable centralized management of the cluster stack.

Why this answer

The Control Plane IP allows the FMC to communicate with the entire cluster as a single entity, rather than needing to manage individual nodes separately.

Practice this question →
18
Multi-Selecthard

An engineer is troubleshooting a high availability failover issue in a Cisco Secure Firewall Threat Defense pair. Which THREE conditions will trigger an automatic failover event in an Active/Standby deployment? (Choose three)

Select 3 answers
A.Failure of designated monitored interfaces exceeding the failure threshold count.
B.Loss of power or complete hardware crash on the active unit.
C.An FMC software policy deployment to the standby unit.
D.Loss of keepalive heartbeats across the dedicated failover link.
E.A minor latency spike of 5 milliseconds on an internal routed data interface.
AnswersA, B, D

Monitored interface failures exceeding thresholds trigger failover.

Why this answer

Failover triggers include unit power loss, critical interface failure thresholds being met, kernel/hardware crashes, or failure of health check heartbeats over the failover link.

Practice this question →
19
MCQmedium

An administrator is configuring a secure firewall deployment in an environment where dynamic routing via OSPF is required across multiple security zones. Which configuration requirement must be met on the Cisco Secure Firewall Threat Defense?

A.OSPF neighbor adjacencies must terminate on the firewall management interface.
B.OSPF requires all participating interfaces to be assigned to the exact same security zone.
C.OSPF must be enabled globally, associated with specific areas, and enabled on the specific routed interfaces belonging to security zones.
D.OSPF can only be enabled on transparent bridge virtual interfaces (BVIs).
AnswerC

Dynamic routing protocols like OSPF are configured globally and enabled per routed interface.

Why this answer

OSPF on FTD requires configuring OSPF routing processes via FMC, defining areas, enabling router IDs, and explicitly identifying the interfaces participating in OSPF routing.

Practice this question →
20
MCQmedium

When deploying an FTD in a virtual environment, what is the primary role of the 'GigabitEthernet0/0' interface by default?

A.Failover link.
B.Management interface.
C.Data transit.
D.State link.
AnswerB

The first interface is often management.

Why this answer

In most virtual FTD deployments, the first interface is typically reserved for the management or diagnostic connectivity.

Practice this question →
21
MCQeasy

Which component is mandatory for managing multiple FTD devices in a distributed enterprise deployment?

A.Firepower Management Center (FMC)
B.Cisco Secure Workload
C.Cisco DNA Center
D.Firepower Device Manager (FDM)
AnswerA

FMC provides the centralized policy management required for multiple devices.

Why this answer

Firepower Management Center (FMC) is the centralized management platform required to manage and orchestrate policies across multiple FTD appliances.

Practice this question →
22
Multi-Selectmedium

An administrator is configuring high availability for Cisco Secure Firewall Threat Defense using Cisco FMC. Which TWO configuration steps are required during the initial setup of an Active/Standby HA pair? (Choose two)

Select 2 answers
A.Configure a dedicated failover interface and IP address scheme for stateful heartbeat communication.
B.Configure the management interfaces to use DHCP so the standby unit can adopt the primary IP address.
C.Ensure both units are configured in different firewall modes (one routed, one transparent).
D.Assign Primary and Secondary roles to the respective firewall units in FMC.
E.Disable stateful synchronization to improve failover switching speed.
AnswersA, D

A dedicated failover link is required for health monitoring and state sync.

Why this answer

Active/Standby HA setup requires assigning roles (Primary/Secondary), configuring the failover link interface parameters, and matching interface configurations.

Practice this question →
23
Multi-Selecthard

An administrator is configuring inline interface pairs on a Cisco Secure Firewall Threat Defense device. Which THREE characteristics apply to inline deployment mode? (Choose three)

Select 3 answers
A.Inline interfaces require SPAN or TAP configurations on upstream core switches to receive mirrored traffic copies.
B.Asymmetric routing must be carefully managed or avoided because inline inspection expects to see both directions of a TCP flow.
C.Inline sets can be configured with hardware bypass (Fail Open) settings to maintain network connectivity if the device loses power.
D.The firewall sits directly in the traffic path, allowing it to inspect and drop malicious packets before they reach destination hosts.
E.Inline mode prevents the firewall from operating in routed mode.
AnswersB, C, D

Inline inspection requires seeing both forward and return paths for stateful analysis.

Why this answer

Inline mode inspects traffic live, can drop packets based on policy or threats, and supports hardware bypass (fail-open) capabilities.

Practice this question →
24
MCQmedium

You are deploying an FTD unit in transparent mode. Which requirement must be met for the management interface and data interfaces during the initial configuration?

A.Transparent mode is only supported when using the FTD inside a virtual port channel (vPC).
B.The FTD must be configured with a bridge group, and the management interface must have an IP address for connectivity.
C.Data interfaces must be configured with an IP address on the same subnet as the management interface.
D.The management interface must be on a separate physical switch from the data interfaces.
AnswerB

Bridge groups are required for L2 switching, and management IP is essential for control.

Why this answer

In transparent mode, the FTD acts as a Layer 2 firewall. The management interface must be configured to provide access to the device, but the data interfaces do not require IP addresses for traffic processing, although they must be bridged.

Practice this question →
25
Multi-Selectmedium

Which TWO of the following are valid methods for deploying an FTD appliance?

Select 2 answers
A.As a hardware module inside a Cisco Nexus switch
B.As a Docker container on a Linux host
C.As an OS-level package on a Windows server
D.As a virtual machine on ESXi
E.As a hardware appliance
AnswersD, E

FTDv is fully supported on VMware.

Why this answer

FTD can be deployed on dedicated hardware appliances or as a virtual machine in various hypervisors or cloud platforms.

Practice this question →
26
Multi-Selecthard

An enterprise network architect is designing high availability for Cisco Secure Firewall Threat Defense using static route tracking and IP SLA. Which THREE components are essential for implementing robust static route tracking? (Choose three)

Select 3 answers
A.An IP SLA monitor or BFD session configured to periodically ping or probe the target next-hop IP address.
B.A tracking object that references the IP SLA operation and reports its up/down state.
C.A BGP peer group session terminating on the firewall management interface.
D.An active cluster control link across three physical security modules.
E.A backup static route configured with a higher metric, tied to the tracking object so it activates when the primary route fails.
AnswersA, B, E

IP SLA / BFD probes test the reachability of the gateway.

Why this answer

Static route tracking requires an IP SLA probe (or BFD), a tracking object that evaluates the probe status, and a static route tied to that tracking object.

Practice this question →
27
MCQhard

In an FTD clustering deployment, how does the control plane communicate state information between the master and slave units?

A.Via the Management Interface.
B.Via the backplane bus protocol.
C.Via the Data Link.
D.Via the Control Link.
AnswerD

The Control Link synchronizes cluster state and health information.

Why this answer

In FTD clustering, the Control Link (CL) is responsible for heartbeat and state synchronization between the master unit and the subordinate units.

Practice this question →
28
MCQhard

An administrator needs to deploy an FTD in inline mode for IPS functionality but must ensure that the traffic remains uninterrupted if the software process fails. Which feature should be enabled?

A.Set the FTD to passive mode.
B.Enable high availability failover.
C.Implement ECMP routing.
D.Configure the interfaces as a hardware bypass pair.
AnswerD

Hardware bypass allows traffic to pass through the interface pair physically if the system is down.

Why this answer

The fail-open feature (hardware bypass) on supported FTD interfaces ensures that traffic continues to flow even if the FTD software fails or reboots.

Practice this question →
29
MCQeasy

Which FTD deployment mode is best suited for an environment where the device should monitor traffic without performing any blocking or dropping actions?

A.Transparent mode
B.Inline mode
C.Routed mode
D.Passive mode
AnswerD

Passive mode only receives copies of traffic for analysis.

Why this answer

Passive mode is specifically designed for monitoring traffic via a SPAN or TAP port without impacting traffic flow.

Practice this question →
30
MCQhard

An administrator is deploying Cisco Secure Firewall Virtual in a Microsoft Azure environment using automated templates. The deployment requires multiple network interfaces for management, internal, and external zones. How does Azure assign IP configurations to these virtual network interfaces (NICs)?

A.Azure relies on stateful ARP broadcasts to dynamically allocate IPs to virtual firewall subinterfaces.
B.Azure assigns IP configurations via DHCP directly to each attached virtual NIC, which must correspond to the FMC interface settings.
C.IP addresses must be manually hardcoded inside the cloud-init script using API tokens.
D.The firewall assigns static IP addresses to the Azure fabric controllers via BGP peering.
AnswerB

Azure VNets provide IP addresses via DHCP to the guest OS interfaces, which are mapped inside the firewall configuration.

Why this answer

Azure allocates private IP addresses from the Azure Virtual Network (VNet) subnet via DHCP to the virtual machine's NICs, which must then match the interface configuration defined in the firewall deployment template.

Practice this question →
31
Multi-Selectmedium

An administrator is configuring security zones on a Cisco Secure Firewall Threat Defense. Which TWO rules regarding security zones and interface assignments are correct? (Choose two)

Select 2 answers
A.Every security zone must contain at least one BVI interface.
B.Security zones replace the need for Access Control Policies entirely.
C.Security zones are only supported in transparent mode and cannot be used in routed mode deployments.
D.Multiple interfaces (such as physical ports, subinterfaces, or EtherChannels) can be grouped into a single security zone.
E.A single physical or logical interface can be a member of only one security zone at any given time.
AnswersD, E

Security zones can aggregate multiple interfaces for unified policy application.

Why this answer

Security zones can contain multiple interfaces, but a single physical or logical interface can only belong to one security zone at a time.

Practice this question →
32
MCQmedium

An organization is planning to deploy a Cisco Secure Firewall Threat Defense Cluster using three Secure Firewall 9300 security modules to handle a massive aggregate throughput requirement. Which consideration is critical when designing this cluster?

A.All security modules in the cluster must be identical in model, memory, and interface module composition.
B.Cluster nodes can be spread across different geographical data centers over high-latency WAN links.
C.The control node processes all data traffic while data nodes only handle control plane heartbeats.
D.Clustering requires transparent mode; routed mode is unsupported on clustered Secure Firewall platforms.
AnswerA

Clustering requires uniform hardware models and matching interface configurations across all cluster members.

Why this answer

In a firewall cluster, one unit is automatically elected as the control node, while the others act as data nodes. All units share a common configuration and distributed connection table, but session handling is managed across the cluster nodes via a central cluster control link.

Practice this question →
33
Multi-Selecteasy

Which TWO FTD interface types are commonly used for connectivity to an ISP?

Select 2 answers
A.Cluster control link.
B.Passive interface.
C.Routed interface.
D.Bridge group interface.
E.Sub-interface.
AnswersC, E

Standard for ISP connections.

Why this answer

Routed interfaces are standard for ISP connectivity, often using sub-interfaces for VLAN-based segmenting.

Practice this question →
34
MCQeasy

An administrator is deploying a Cisco Secure Firewall Virtual (Fv) appliance in an Amazon Web Services (AWS) environment. Which licensing model is typically supported for traffic throughput and feature activation during this cloud deployment?

A.Activation via automatic license generation from the Amazon VPC DHCP options list.
B.Smart Licensing (BYOL) and Pay-As-You-Go (PAYG) through the AWS Marketplace.
C.Perpetual hardware-locked PAK files applied via the command line interface.
D.Activation exclusively through an on-premises Cisco Smart Software Manager (CSSM) satellite server without internet access.
AnswerB

AWS and Azure deployments support both BYOL (Smart Licensing) and PAYG billing models.

Why this answer

Cisco Secure Firewall Virtual supports both Bring Your Own License (BYOL) using Smart Licensing and Pay-As-You-Go (PAYG) directly from cloud marketplaces.

Practice this question →
35
MCQmedium

An administrator is deploying a Cisco Secure Firewall Threat Defense Virtual (FTDv) on-premises using a KVM hypervisor. During the initial deployment, the virtual machine fails to boot and console logs indicate an issue with interface mapping. What is a key requirement for physical interface mapping on KVM-based FTDv deployments?

A.KVM requires SR-IOV drivers for the management interface only.
B.Management must be mapped to eth2 while data interfaces use eth0 and eth1.
C.Interface eth0 must be dedicated exclusively to the management network, and data interfaces must follow a strict sequential mapping starting with eth1.
D.All interfaces must be bundled into a single virtio bridge without VLAN tagging.
AnswerC

The FTDv architecture demands eth0 for management, with subsequent interfaces mapped sequentially for internal/external data planes.

Why this answer

KVM deployments require correct mapping of virtual NICs (vNICs) to specific bridge or SR-IOV interfaces, where eth0 is strictly reserved for management, eth1 for internal, and eth2 for external data traffic.

Practice this question →
36
MCQeasy

A network security engineer is setting up a high availability (HA) pair for two Cisco Secure Firewall Threat Defense devices managed by Cisco FMC. Which prerequisite condition must be met between the primary and secondary units before configuring the HA pair?

A.The primary unit must be configured in routed mode while the secondary unit is in transparent mode.
B.The secondary unit must be running a newer software version than the primary unit to support failover synchronization.
C.Both units must have different management IP addresses assigned to their respective management interfaces.
D.The data interfaces must use dynamic DHCP addressing to ensure seamless failover state transfer.
AnswerC

Each unit in an HA pair must retain its own unique management IP address for FMC communication, even after pairing.

Why this answer

Before configuring an HA pair, both units must have the same exact model, identical license configurations, the same software version, and identical interface configurations/naming.

Practice this question →
37
MCQeasy

In routed mode, what is the purpose of the 'Name' assigned to an interface?

A.To define the interface for use in security policies and NAT.
B.To define the failover priority.
C.To change the speed of the physical interface.
D.To set the MAC address.
AnswerA

The interface name acts as the identifier in the configuration.

Why this answer

The name assigned to an interface (e.g., 'outside') is used in policy rules and NAT definitions to identify the zone or security level.

Practice this question →
38
Multi-Selectmedium

An administrator is deploying static route tracking combined with IP SLA on a Cisco Secure Firewall Threat Defense device managed by Cisco FMC. Which TWO components must be configured to implement this feature successfully? (Choose two)

Select 2 answers
A.A secondary management interface configured for out-of-band SLA telemetry.
B.A Track object that monitors the state of the IP SLA operation.
C.A BGP routing peer group that automatically advertises SLA status to upstream routers.
D.An IP SLA monitor object defining the target IP and probe parameters (such as ICMP Echo).
E.An Access Control Rule explicitly permitting ICMP traffic destined for the firewall's loopback interface.
AnswersB, D

A tracking object references the IP SLA object to monitor its up/down state.

Why this answer

Route tracking requires creating an IP SLA Monitor object to test reachability and configuring a Track object linked to that SLA, which is then referenced in the static route.

Practice this question →
39
MCQhard

An engineer has deployed an active/standby High Availability pair of Cisco Secure Firewall Threat Defense devices. A failure occurs on the active unit, and a failover successfully takes place. However, upon recovery of the original active unit, it immediately resumes its role as the active unit, causing a brief secondary interruption. Which failover setting governs this behavior?

A.MAC Address Persistence Timer
B.HEMS Poll Frequency
C.Stateful Failover Sync Interval
D.Failover Preempt Configuration
AnswerD

Preempt settings control whether the primary unit automatically takes back the active role when it recovers.

Why this answer

The 'Preempt' setting dictates whether a recovered primary unit will reclaim its active role from the current active unit. By default, preemption may be enabled or disabled depending on configuration preferences.

Practice this question →
40
Multi-Selecthard

An engineer is configuring NGIPS inline sets on a Cisco Secure Firewall Threat Defense deployment. Which THREE configuration options or behaviors are associated with inline sets? (Choose three)

Select 3 answers
A.Snort Bypass can be configured to pass traffic uninspected if the inspection engine is overloaded.
B.Inline sets automatically function as dynamic OSPF routers for neighboring switches.
C.Inline normalization can be enabled to proactively mitigate packet evasion techniques.
D.Traffic entering one interface of the inline set is inspected and forwarded out the paired interface.
E.Inline sets require every participating interface to have a unique Layer 3 IP address.
AnswersA, C, D

Snort Bypass protects against traffic drops during high CPU or memory load.

Why this answer

Inline sets inspect traffic passing between paired interfaces, support Snort bypass options, and can utilize tap or inline normalization features.

Practice this question →
41
MCQmedium

An administrator is deploying an FTD in a virtual environment. What is the minimum recommended vCPU and RAM configuration for an FTDv instance?

A.8 vCPUs, 16GB RAM
B.4 vCPUs, 8GB RAM
C.1 vCPU, 2GB RAM
D.2 vCPUs, 4GB RAM
AnswerB

This meets the Cisco deployment requirements for FTDv.

Why this answer

FTDv instances have specific requirements (e.g., 4 vCPUs and 8GB RAM minimum for basic functionality) which must be met to ensure stability.

Practice this question →
42
Multi-Selectmedium

An engineer needs to deploy a Cisco Secure Firewall Threat Defense in transparent firewall mode. Which TWO statements describe characteristics of transparent mode? (Choose two)

Select 2 answers
A.Every interface in transparent mode must have a unique Layer 3 subnet IP address for routing.
B.NAT is fully unsupported across all transparent firewall deployments.
C.The firewall operates as a Layer 2 bridge, forwarding frames based on destination MAC addresses.
D.Bridge Virtual Interfaces (BVIs) are assigned IP addresses to allow management access and gateway functionality.
E.Dynamic routing protocols like OSPF and EIGRP are fully supported on BVI interfaces.
AnswersC, D

Transparent mode performs Layer 2 bridging.

Why this answer

Transparent mode bridges traffic across interfaces in a bridge group using BVIs, acting as a stealth firewall at Layer 2.

Practice this question →
43
MCQhard

An enterprise is deploying a Cisco Secure Firewall Threat Defense cluster. During the setup of the Cluster Control Link (CCL), the administrator must ensure specific networking criteria are met. What is a primary design requirement for the CCL interface?

A.It must be a dedicated, high-bandwidth, low-latency Layer 2 link between cluster nodes.
B.It must share the same physical interface as the external data interfaces using 802.1Q subinterfaces.
C.It must be routed across a public Layer 3 MPLS cloud with dynamic BGP peering.
D.It must be configured with NAT overload enabled to translate inter-node control packets.
AnswerA

CCL traffic is sensitive to latency and bandwidth, requiring a dedicated Layer 2 connection between nodes.

Why this answer

The Cluster Control Link requires low latency, high bandwidth, and a dedicated non-routable Layer 2 connection (or directly connected point-to-point links) between cluster members.

Practice this question →
44
MCQhard

An administrator is configuring an NGIPS deployment using a Cisco Secure Firewall Threat Defense inline set. Traffic needs to be analyzed, but certain trusted bulk data transfers should bypass the Snort inspection engine without breaking the inline flow. Which feature should the administrator configure?

A.Deploy a BVI interface pair in transparent mode with asymmetric routing enabled.
B.Configure a Network Analysis Policy (NAP) to use the Inline Tap mode for the specific VLAN range.
C.Enable an Inline Set with Snort Bypass enabled so traffic passes through the hardware interface pair without inspection when Snort is busy.
D.Configure an Access Control Policy rule with the action set to Trust, combined with an Intrusion Policy set to drop.
AnswerC

Snort Bypass on an inline set ensures that if the inspection engine is overloaded, traffic can either drop or pass uninspected based on the configuration.

Why this answer

Inline Bypass or Advanced Inspection and Prevention settings allow traffic to bypass Snort inspection under specific conditions. Specifically, Snort performance overload or configured bypass settings on inline sets can drop or pass traffic without inspection.

Practice this question →
45
Multi-Selecthard

Which THREE features are critical for maintaining a stable FTD cluster?

Select 3 answers
A.Individual IP addresses for every member on every network.
B.Synchronized FMC management.
C.EtherChannel (Port Channel) for data traffic.
D.External load balancer for traffic scrubbing.
E.Dedicated cluster control link.
AnswersB, C, E

Required for policy consistency.

Why this answer

Clustering requires a dedicated control link for health, a data port channel for traffic, and consistent configuration via the FMC.

Practice this question →
46
MCQmedium

An administrator is deploying a Cisco Secure Firewall Threat Defense High Availability pair. During the initial configuration in Cisco FMC, the administrator assigns specific priority values. How does the failover process use the primary and secondary unit designations and priorities?

A.The active unit is chosen based on health status, preemption settings, and designated failover priorities.
B.Both units actively share the workload in an active-active load-balanced state.
C.The unit designated as Primary always becomes Active, ignoring preemption or health status.
D.The unit with the lowest management IP address is automatically elected as Active.
AnswerA

Failover selection evaluates unit health, priorities, and preemption settings to elect the active unit.

Why this answer

In an Active/Standby HA pair, the unit configured with the higher priority or designated role determines preemption and active state behavior when both units boot up simultaneously.

Practice this question →
47
MCQeasy

In an FTD cluster, which unit is responsible for assigning flow ownership to other units in the cluster?

A.The FMC
B.The subordinate unit
C.The master unit
D.The external load balancer
AnswerC

The master unit coordinates cluster resources and flow assignments.

Why this answer

The master unit in an FTD cluster handles management, orchestration, and the distribution/assignment of traffic flows to subordinate units.

Practice this question →
48
MCQeasy

When registering a new Cisco Secure Firewall Threat Defense device to Cisco Defense Orchestrator (CDO) or Cisco FMC, what is the primary prerequisite protocol or connectivity requirement that must be established from the managed device toward the management platform?

A.An active SNMPv3 trap receiver configured on the manager pointing to the FTD.
B.Inbound SSH access from the management platform IP address to the firewall management interface.
C.An IPSec site-to-site VPN tunnel terminating on the data interfaces.
D.Outbound TCP connection on port 8305 from the FTD to the manager's IP address or registration FQDN.
AnswerD

The FTD device establishes an outbound secure tunnel (sftunnel) on TCP 8305 to the management platform.

Why this answer

Managed devices initiate outbound secure communication (typically over TCP port 8305 / sftunnel) to the management platform (FMC or CDO).

Practice this question →
49
Multi-Selectmedium

An administrator is configuring port channels (EtherChannels) on Cisco Secure Firewall Threat Defense interfaces. Which TWO requirements or guidelines must be followed? (Choose two)

Select 2 answers
A.LACP (Link Aggregation Control Protocol) can be used to dynamically negotiate and manage the port channel.
B.All physical member ports assigned to a port channel must have matching speed, duplex, and mode settings.
C.Port channel interfaces cannot be assigned to security zones.
D.Port channels are restricted to passive NGIPS monitoring interfaces only.
E.Active/Standby HA pairs must have completely different port channel ID numbers on the standby unit.
AnswersA, B

LACP is fully supported for dynamic EtherChannel formation.

Why this answer

Port channels require matching channel-group configurations, identical speed/duplex/mode on member ports, and support LACP.

Practice this question →
50
Multi-Selecthard

Which THREE items are synchronized across an FTD high availability pair?

Select 3 answers
A.NAT tables.
B.Management interface IP.
C.Connection/Session states.
D.Physical interface counters.
E.Configuration policies.
AnswersA, C, E

Required to maintain existing sessions.

Why this answer

HA synchronization includes NAT tables, connection/session states, and the system configuration policies.

Practice this question →
51
MCQeasy

An administrator is deploying a new Cisco Secure Firewall Threat Defense device and needs to ensure that the firewall performs layer 3 routing while keeping the existing subnet architecture completely transparent to the upstream router. Which firewall mode must be selected during initial configuration?

A.Inline mode
B.Routed mode
C.Transparent mode
D.Passive mode
AnswerC

Transparent mode operates at Layer 2 and bridges traffic without changing subnet schemes.

Why this answer

In transparent mode, the firewall acts like a Layer 2 bridge. The upstream and downstream networks remain in the same subnet, making the firewall transparent to layer 3 routing.

Practice this question →
52
Multi-Selectmedium

An administrator is planning the deployment of Cisco Secure Firewall Virtual in a public cloud environment (AWS or Azure). Which TWO deployment practices are recommended for ensuring high availability and performance? (Choose two)

Select 2 answers
A.Deploy multiple virtual network interfaces (NICs) to separate management, internal, and external traffic paths.
B.Disable Smart Licensing to avoid cloud internet egress fees.
C.Use physical serial console cables attached to the hypervisor for initial configuration.
D.Rely solely on single-NIC deployments with VLAN subinterfaces trunking all cloud traffic.
E.Select an instance type and throughput license tier that aligns with expected cloud throughput demands.
AnswersA, E

Using multiple NICs isolates management and data traffic planes.

Why this answer

Cloud deployments require proper instance sizing, multiple NIC configurations for separating management and data planes, and cloud-native HA mechanisms.

Practice this question →
53
Multi-Selectmedium

Which TWO of the following are valid high availability modes for FTD?

Select 2 answers
A.Active/Active (non-clustered).
B.Failover-on-demand.
C.Active/Standby.
D.Clustering.
E.Load-Balanced Passive.
AnswersC, D

Standard failover mode.

Why this answer

FTD supports active/standby and clustering for high availability.

Practice this question →
54
MCQeasy

In which mode does the FTD firewall act as a Layer 3 hop and perform NAT?

A.Passive mode
B.Inline mode
C.Routed mode
D.Transparent mode
AnswerC

Routed mode supports Layer 3 functions including NAT.

Why this answer

Routed mode is the standard deployment mode where the FTD operates as a Layer 3 device and supports NAT and routing protocols.

Practice this question →
55
MCQhard

An administrator is configuring static route tracking on a Cisco Secure Firewall Threat Defense deployment to handle link failure. If the tracked object goes down, the static route should be removed from the routing table. Where is this configuration managed when using Cisco FMC?

A.Under Devices > Device Management > Routing > Static Route, by editing the route and selecting a Monitor Track object.
B.Under Policies > Access Control > Routing Policies, by enabling SLA tracking hooks.
C.Under System > Configuration > High Availability > Route Tracking.
D.Under Objects > Object Management > SIEM > Route Track.
AnswerA

FMC allows administrators to link a static route directly to a tracked object (such as an ICMP or TCP ICMP Echo SLA) inside the Static Route configuration dialog.

Why this answer

Static route tracking in FMC is managed under Devices > Device Management > Routing > Static Route, where you associate an IP SLA Monitor object or Track object to a specific static route entry.

Practice this question →
56
MCQeasy

Which interface configuration mode allows the FTD to handle traffic across multiple physical links as a single logical interface?

A.Redundant Interface
B.Bridge Group
C.Sub-interface
D.Port Channel
AnswerD

Port channel aggregates links.

Why this answer

A Port Channel (or EtherChannel) aggregates multiple physical interfaces into one logical bundle.

Practice this question →
57
Multi-Selecthard

You are configuring High Availability for two FTD devices. Which TWO conditions must be met for a successful failover state? (Choose two)

Select 2 answers
A.The failover link must be connected to a public-facing switch.
B.The devices must use different management IP addresses.
C.The standby unit must have a higher priority value than the active unit.
D.The devices must be running the exact same version of FTD software.
E.The devices must use different serial numbers.
AnswersB, D

Each unit in an HA pair requires its own management IP address.

Why this answer

FTD failover requires identical hardware/software and specific link configuration for state synchronization.

Practice this question →
58
Multi-Selecteasy

Which THREE items are required to create a port channel on an FTD device?

Select 3 answers
A.A static route to the port channel
B.LACP configuration
C.Two or more physical interfaces
D.A physical bypass module
E.A logical Port-Channel interface
AnswersB, C, E

LACP negotiates the aggregation between devices.

Why this answer

A port channel requires multiple physical interfaces, a logical port-channel interface ID, and the LACP protocol settings.

Practice this question →
59
Multi-Selectmedium

Which TWO of the following are valid reasons to use Transparent Mode?

Select 2 answers
A.To increase throughput by ignoring L3 headers.
B.To act as a Layer 3 gateway.
C.To enable dynamic routing.
D.Simplified L2 insertion.
E.Network address transparency.
AnswersD, E

It acts as a bump-in-the-wire.

Why this answer

Transparent mode is used when you cannot change the IP addressing scheme of the network and when you need to insert security without routing changes.

Practice this question →
60
Multi-Selecthard

When considering virtual FTD deployments, which THREE factors significantly impact the performance of the instance?

Select 3 answers
A.The number of configured Access Control Rules
B.The amount of provisioned RAM
C.The number of active management sessions
D.The type of virtual network adapter
E.Number of allocated CPU cores
AnswersB, D, E

RAM is critical for the FTD state table and packet buffer.

Why this answer

Performance in virtual FTD is constrained by hardware resources like CPU cores, RAM, and the efficiency of the virtual network adapter.

Practice this question →
61
MCQeasy

Which type of FTD interface should be configured to connect to a trunk port on a switch?

A.Physical interface without a VLAN ID.
B.Management interface.
C.Port channel interface.
D.Sub-interface with a VLAN tag.
AnswerD

VLAN tagging is defined via sub-interfaces.

Why this answer

A sub-interface, when assigned a specific VLAN ID, is used to process traffic on a trunked link.

Practice this question →
62
Multi-Selecteasy

Which TWO interface modes are available when configuring an intrusion prevention (NGIPS) security policy on a Cisco Secure Firewall Threat Defense device? (Choose two)

Select 2 answers
A.Bridged Layer 4 mode
B.NAT-patrolled mode
C.Inline mode
D.Promiscuous trunk mode
E.Passive mode
AnswersC, E

Inline mode allows the NGIPS engine to inspect traffic and drop malicious packets in real-time.

Why this answer

NGIPS policies on FTD can be deployed using inline mode (to inspect and drop traffic) or passive mode (to monitor and log traffic without dropping).

Practice this question →
63
MCQhard

When using clustering with FTD, what is the 'Flow Owner' in the context of traffic distribution?

A.The master unit that manages the configuration.
B.The unit that maintains the connection state for a specific flow.
C.Any unit that has the highest CPU availability.
D.The unit that performs the SSL decryption for the flow.
AnswerB

Ownership ensures stateful inspection consistency across the cluster.

Why this answer

In a cluster, the Flow Owner is the specific unit that has received the initial TCP SYN for a connection and is responsible for all subsequent packets in that flow to ensure consistency.

Practice this question →
64
Multi-Selecthard

Which THREE considerations must be addressed when deploying FTDv in a public cloud?

Select 3 answers
A.Integration with cloud route tables for failover.
B.VPC security group constraints.
C.Cloud-specific instance sizing.
D.Hardware bypass capabilities.
E.Clustering using local control links.
AnswersA, B, C

Required for traffic redirection.

Why this answer

Cloud deployments require API-based routing, specific instance sizing, and VPC-level security group awareness.

Practice this question →
65
Multi-Selectmedium

When deploying Cisco Secure Firewall Threat Defense in transparent mode, which TWO operational characteristics or restrictions apply to the deployment? (Choose two)

Select 2 answers
A.Every physical interface must be configured with a unique public routable IP address.
B.The firewall must act as the primary DHCP server for all downstream VLANs.
C.The firewall bridges traffic at Layer 2 between interfaces belonging to the same BVI bridge group.
D.Network Address Translation (NAT) is fully supported for changing IP addresses across interfaces.
E.Dynamic routing protocols like OSPF and RIP cannot run across transparent firewall interfaces.
AnswersC, E

Transparent mode bridges Layer 2 traffic across BVI members.

Why this answer

Transparent firewalls operate at Layer 2, bridge traffic using BVIs, do not support dynamic routing protocols, and require management IP addresses for the bridge group.

Practice this question →
66
MCQeasy

A security engineer is deploying a Cisco Secure Firewall Threat Defense device inline in front of a critical server farm. The goal is to inspect all incoming and outgoing traffic for intrusions without modifying the IP addressing schema of the servers. Which interface mode should be configured on the FTD device?

A.Passive mode
B.Inline mode with a bypass capability
C.SPAN mode
D.Promiscuous mode
AnswerB

Inline mode evaluates traffic passing directly through the interface pair and can drop malicious payloads.

Why this answer

Inline mode places the firewall directly in the path of traffic, allowing it to inspect, drop, or modify packets while operating transparently or via routed configurations.

Practice this question →
67
MCQeasy

You are configuring static route tracking on an FTD device. What is the primary purpose of this configuration?

A.To load-balance traffic across ISPs.
B.To increase the throughput of the interface.
C.To dynamically adjust the MTU of the link.
D.To ensure traffic is only routed through a verified path.
AnswerD

Tracking ensures the gateway is alive before using the route.

Why this answer

Static route tracking allows the firewall to monitor the availability of a path using ICMP or other probes and remove the route from the routing table if the probe fails.

Practice this question →
68
MCQeasy

When deploying a Cisco Secure Firewall Threat Defense in transparent mode, how are the firewall interfaces configured to pass traffic between segments without routing?

A.Interfaces are grouped into a Bridge Virtual Interface (BVI) bridge group that acts as a Layer 2 bridge.
B.Interfaces are configured with dynamic NAT overload to translate Layer 2 MAC addresses into Layer 3 IPs.
C.The firewall acts as an 802.1Q trunk port where all VLANs are terminated on a single subinterface.
D.Each physical interface is assigned a distinct IP address in the same subnet.
AnswerA

Transparent firewalls use BVIs to bridge traffic at Layer 2 across interfaces.

Why this answer

In transparent mode, the firewall bridges traffic between interfaces using a Bridge Virtual Interface (BVI). The BVI is assigned an IP address for management and Layer 3 functions, while the physical interfaces belong to the bridge group.

Practice this question →
69
MCQmedium

You are troubleshooting a port channel failure on an FTD device. The port channel is 'Up/Down'. What is the most likely cause?

A.Insufficient license.
B.The FTD is in transparent mode.
C.Mismatched LACP configuration.
D.Physical cable damage.
AnswerC

LACP mismatches prevent the logical bundle from becoming fully operational.

Why this answer

An 'Up/Down' status for a port channel usually indicates that LACP negotiation is failing between the FTD and the connected switch.

Practice this question →
70
Multi-Selecthard

When deploying a Cisco Secure Firewall Threat Defense virtual appliance (FPRv) in a public cloud environment such as Microsoft Azure, which TWO architectural considerations or limitations must be accounted for? (Choose two)

Select 2 answers
A.User-Defined Routes (UDRs) in Azure must be configured to point traffic destined for other subnets to the FTDv internal interface IP.
B.A minimum of three distinct network interfaces (Management, Inside, and Outside) must be configured in Azure.
C.The FTDv management interface can be shared with the data plane traffic if bandwidth optimization is enabled.
D.Physical clustering using dedicated control interfaces is natively supported in Azure just like on-prem hardware.
E.Dynamic routing protocols (BGP/OSPF) are entirely unsupported on virtual appliances deployed in public clouds.
AnswersA, B

Azure virtual networks rely on User-Defined Routes to steer traffic through the virtual firewall appliance.

Why this answer

Azure deployments have specific constraints regarding throughput licensing models, interface requirements (Management, Inside, Outside), and lack of native support for certain on-prem features like traditional physical clustering.

Practice this question →
71
MCQhard

When configuring an NGIPS appliance in passive mode, how does the system handle traffic flow to ensure monitoring without impacting the production network?

A.It uses an inline set with a bypass feature enabled.
B.It drops malicious packets by sending TCP resets to the source.
C.It receives a copy of traffic via a SPAN or TAP port and performs out-of-band analysis.
D.It requires an EtherChannel configuration to load balance traffic.
AnswerC

Passive deployment relies on traffic mirroring.

Why this answer

Passive mode utilizes a TAP or SPAN port to ingest a copy of the traffic. It does not sit in the traffic path, meaning it cannot block traffic directly.

Practice this question →
72
MCQhard

An administrator is deploying a Cisco Secure Firewall Threat Defense Virtual (FTDv) in Microsoft Azure. The architecture calls for a 3-NIC deployment (Management, Inside, and Outside). After deployment, asymmetric routing issues are observed because Azure Load Balancer is forwarding return traffic directly back to a different backend instance. What configuration must be applied to prevent asymmetric drops?

A.Enable Strict Asymmetric Routing Bypass mode in the FTDv Advanced Firewall Settings.
B.Disable the Azure UDR (User Defined Route) on the inside subnet.
C.Convert the FTDv deployment from routed mode to transparent mode.
D.Configure Source NAT (SNAT) on the FTDv so that traffic appears to originate from the firewall interface IP, ensuring symmetrical return paths.
AnswerD

Using SNAT ensures that return traffic from servers comes back to the firewall instance's IP address rather than directly to the client, preventing asymmetric routing drops.

Why this answer

Cloud deployments utilizing load balancers often require enabling SNAT (Source NAT) on the firewall so that return traffic flows back through the exact same firewall instance, preventing asymmetric drop behavior.

Practice this question →
73
Multi-Selectmedium

An administrator is preparing to deploy Cisco Secure Firewall Threat Defense in passive NGIPS mode connected to a Catalyst switch. Which TWO configuration steps on the switch and firewall are necessary for successful packet inspection? (Choose two)

Select 2 answers
A.Configure the firewall data interfaces to operate in passive mode so they do not attempt to forward or drop traffic.
B.Enable dynamic OSPF routing between the switch and the firewall's passive interface.
C.Configure a SPAN (Switched Port Analyzer) or RSPAN session on the upstream switch to mirror traffic toward the firewall's passive interface.
D.Assign a default gateway IP address to the passive interface to route return packets back to clients.
E.Configure an inline set pairing the passive interfaces with a hardware bypass module.
AnswersA, C

Passive interfaces analyze traffic without forwarding or dropping.

Why this answer

Passive mode requires configuring a SPAN session (or TAP) on the switch to mirror traffic and configuring passive interfaces on the FTD to ingest and inspect that mirrored stream.

Practice this question →
74
MCQmedium

An engineer is troubleshooting a stateful failover issue in a Cisco Secure Firewall Threat Defense Active/Standby high availability pair. The firewall units are passing data traffic, but failover state synchronization fails. Which dedicated interface must be verified for correct physical connectivity and configuration?

A.The Cluster Control Link (CCL)
B.The Management Interface (eth0)
C.The Failover and State Link
D.The Diagnostic Interface
AnswerC

The failover link and state link carry health checks and stateful session synchronization data between the units.

Why this answer

Stateful failover relies on the Failover Link (and optionally a Stateful Failover Link) to replicate connection tables, translation tables, and other stateful data between primary and standby units.

Practice this question →
75
Multi-Selecthard

An engineer is troubleshooting a Cisco Secure Firewall Threat Defense clustering deployment where configuration synchronization between the control node and a data node has failed. Which THREE diagnostic steps or log sources should the engineer check? (Choose three)

Select 3 answers
A.Execute the 'show cluster info' and 'show cluster state' commands on the firewall CLI to verify node membership and sync status.
B.Verify physical connectivity, MTU settings, and packet loss on the Cluster Control Link (CCL) interface.
C.Check the BGP routing table on the core switch for missing Autonomous System path attributes.
D.Examine the FMC deployment task history and error logs to identify specific configuration push failures to the cluster nodes.
E.Review the VMware vCenter datastore utilization for disk space errors.
AnswersA, B, D

CLI cluster show commands provide real-time cluster health and membership details.

Why this answer

Troubleshooting cluster sync issues involves examining cluster health status via CLI commands (e.g., 'show cluster info'), reviewing FMC deployment history logs, and verifying Cluster Control Link connectivity.

Practice this question →
Page 1 of 2 · 150 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Deployment questions.

Start 20-question session