75 of 150 questions · Page 2/2 · Deployment · Answers revealed
Which component in an FTD cluster handles the 'Health Check' process to determine if a node is still active?
The control link is specifically for cluster health and synchronization.
Why this answer
The cluster control link is used to exchange heartbeats and health information between cluster members to verify node status.
Which of the following must be identical on both units of an FTD high availability pair to ensure successful synchronization?
Version mismatch is a blocking condition for HA synchronization.
Why this answer
Both units must have the same model, software version, and license capabilities for the HA configuration to function correctly.
An administrator is troubleshooting a Cisco Secure Firewall Threat Defense high availability deployment where MAC address persistence is causing intermittent packet drops after a failover event. What is the role of MAC address persistence in an HA setup?
MAC persistence keeps virtual MAC addresses associated with the active unit, allowing seamless Layer 2 forwarding post-failover.
Why this answer
MAC persistence ensures that the active firewall unit takes over the virtual MAC addresses of the HA pair, ensuring downstream switches immediately update their MAC forwarding tables without waiting for aging timers.
In an FTD high availability pair, what happens to the standby unit if it loses the heartbeat signal on the failover link?
Loss of heartbeat triggers the promotion process.
Why this answer
If the standby unit loses heartbeat signals from the active unit, it assumes the active unit has failed and initiates a failover transition to become the new active unit.
An enterprise is deploying a high-availability cluster of Cisco Secure Firewall Threat Defense devices to scale performance. Which requirement must be met regarding the physical switch infrastructure connecting the cluster nodes?
Cluster control and data interfaces rely on Port Channels connected to upstream/downstream switches to aggregate links and load balance sessions.
Why this answer
Firewall clustering requires specific switch features such as EtherChannel (Port Channels) and often requires specific load-balancing algorithms to distribute traffic across cluster members evenly.
What is the consequence of configuring an FTD interface with 'Non-Promiscuous' mode in a virtualized deployment?
The vSwitch blocks non-destined traffic unless promiscuous mode is enabled.
Why this answer
In virtualized environments (like ESXi), 'Promiscuous mode' is often required on the vSwitch to allow the FTD to see traffic not destined for its own MAC address, which is essential for transparent or passive modes.
An engineer has deployed a Cisco Secure Firewall Threat Defense in transparent firewall mode. Users on the inside segment report they cannot reach a server on the outside segment. The engineer verifies that the BVI (Bridge Virtual Interface) has an IP address in the same subnet as the internal hosts and default gateway. What is a likely reason for traffic being dropped?
Transparent firewalls pass IP traffic by default, but non-IP traffic or specific Layer 2 control protocols require EtherType rules, and proper ARP inspection/learning is necessary.
Why this answer
In transparent mode, non-IP traffic is dropped by default unless EtherType rules are explicitly configured to allow protocols like BPDUs, MPLS, or IPX through the firewall bridge groups.
When deploying a Cisco Secure Firewall Threat Defense device, what is the purpose of configuring Security Zones?
Security zones group interfaces so that access control rules can be applied across multiple interfaces collectively.
Why this answer
Security zones logically group one or more interfaces together, simplifying access control policy enforcement by allowing rules to apply to a zone rather than individual interfaces.
An enterprise is deploying Cisco Secure Firewall Threat Defense virtual appliances on-premises using VMware ESXi. Which THREE prerequisites or hypervisor configurations are required for proper operation? (Choose three)
Proper hardware resource allocation is critical for virtual firewall performance.
Why this answer
VMware ESXi deployments require correct vSwitch/vDS port group configurations (promiscuous mode where needed, or specific VLAN policies), appropriate vCPU/RAM allocation according to sizing guides, and correct dedicated vNIC mapping.
When planning an FTD high availability deployment, which TWO requirements are critical for the link between the two firewalls?
Latency can cause false failover triggers.
Why this answer
The failover link must be dedicated, low-latency, and support sufficient bandwidth for the synchronization of the state table.
An engineer is setting up a Cisco Secure Firewall Threat Defense cluster. Which TWO statements accurately describe the architecture and behavior of FTD clustering? (Choose two)
Clustering assigns a control role to one module and data roles to the others.
Why this answer
Clustering combines multiple devices into a single logical entity with a control node and data nodes, sharing configuration and connection tables.
When configuring an FTD cluster, what is the maximum number of nodes supported in a single cluster?
16 nodes is the supported maximum.
Why this answer
The FTD clustering architecture supports up to 16 nodes in a single cluster.
You are deploying a Cisco Secure Firewall Threat Defense cluster in a data center environment. Which deployment requirement must be strictly followed regarding the control link and data interfaces?
The cluster control link must be dedicated to cluster communication and state synchronization with strict latency requirements.
Why this answer
Clustered FTD units require a dedicated control plane network (control link) with low latency and high bandwidth, separate from data interfaces, to synchronize state and management data.
An engineer is troubleshooting a Cisco Secure Firewall Threat Defense virtual appliance deployed in Microsoft Azure. Connectivity tests show intermittent packet drops. Which THREE troubleshooting steps or configurations should be verified in Azure and FTDv? (Choose three)
UDRs manage routing within Azure subnets.
Why this answer
Azure deployments require checking User Defined Routes (UDRs), Source NAT (SNAT) configurations for load balancers, and Azure NSG (Network Security Group) rules.
When utilizing static route tracking, what value represents the frequency of the tracking probe?
Frequency defines how often the probe is sent.
Why this answer
The SLA Monitor configuration allows you to define the frequency (in seconds) at which the probe is sent to the target.
Which protocol is used by the FTD to communicate with the FMC for management traffic?
The sftunnel uses encrypted TLS for management.
Why this answer
The FTD communicates with the FMC using a secure, proprietary channel over HTTPS/TLS.
An administrator is deploying Cisco Secure Firewall Threat Defense Virtual (FTDv) in an enterprise cloud environment (such as AWS or Azure). Which THREE considerations are unique to cloud-based firewall deployments compared to physical hardware deployments? (Choose three)
Cloud route tables are mandatory for steering traffic through cloud firewall instances.
Why this answer
Cloud deployments involve managing cloud routing tables (UDRs), utilizing specific licensing models (BYOL or Pay-As-You-Go), and managing network interface limits per VM instance.
An administrator is configuring Equal-Cost Multi-Path (ECMP) routing on a Cisco Secure Firewall Threat Defense deployment to balance traffic across two upstream next-hop routers. How does the firewall select the specific path for a given TCP flow?
Flow-based ECMP hashing uses the 5-tuple to keep all packets of a single session traversing the same next-hop router.
Why this answer
ECMP on Cisco Secure Firewall uses a hashing algorithm based on the 5-tuple (source IP, destination IP, source port, destination port, and protocol) to ensure packets belonging to the same flow take the same path.
You are deploying a Cisco Firepower Threat Defense (FTD) device in transparent mode. Which requirement must be met to allow traffic flow through the firewall?
The BVI acts as the L3 interface for the transparent firewall, allowing management traffic.
Why this answer
In transparent mode, FTD acts as a Layer 2 device. It uses bridge groups, and traffic is bridged between interfaces. Since it is L2, the interfaces do not require IP addresses for routing, but the bridge group interface (BVI) needs an IP address for management purposes.
Which THREE of the following are supported methods for FTD failover mechanism?
Synchronizes session tables.
Why this answer
FTD supports stateful failover, redundant interfaces, and clustering for high availability.
When deploying FTD in a virtual environment on AWS, which feature allows the firewall to handle high-bandwidth traffic by distributing it across multiple interfaces using ECMP?
ECMP enables the use of multiple paths to reach the same destination, load-balancing traffic.
Why this answer
ECMP (Equal-Cost Multi-Path) allows routing traffic across multiple equal-cost paths, which is essential for scaling performance in virtual deployments.
You are deploying FTD in a cloud environment. What is the primary purpose of the 'Management Interface' when launching the virtual instance?
The management interface provides the control plane connectivity.
Why this answer
The management interface is used exclusively for the FMC or FDM to configure and manage the FTD appliance. Data traffic is kept separate to maintain security and throughput.
You are deploying a Cisco FTD High Availability pair. During the synchronization process, what occurs when the standby unit fails to receive three consecutive heartbeat hellos from the primary?
Three missed hellos trigger a failover event, promoting the standby to active.
Why this answer
In FTD HA, three consecutive missed hellos trigger a state change, and the standby unit initiates a failover because it assumes the primary has failed.
You are deploying an FTD in AWS. What is the correct way to handle the internal IP addresses of the FTD instances in an HA pair?
This is the standard approach for cloud HA.
Why this answer
In AWS, you assign virtual secondary IPs or use Elastic IPs to ensure that traffic is routed correctly even after a failover event.
When configuring a Port Channel on an FTD, what is the primary benefit of using LACP (Link Aggregation Control Protocol)?
LACP adds intelligence to the port channel interface.
Why this answer
LACP ensures link integrity by performing negotiation and error checking, preventing misconfiguration in the bundle.
You need to implement static route tracking on an FTD to ensure traffic fails over to a secondary ISP. Which object is used to define the reachability check?
SLA Monitors ping a target to determine route viability.
Why this answer
SLA Monitor objects are used to track reachability to a target IP, and the static route is then associated with this monitor.
You are configuring a Cisco Secure Firewall Threat Defense deployment in an AWS environment. Which specific component is required to handle automated failover and route table updates when deploying a clustered or high-availability pair across multiple Availability Zones?
AWS Lambda scripts are officially provided by Cisco to automate route table updates during failover in AWS.
Why this answer
AWS deployments of Cisco Secure Firewall Threat Defense rely on AWS Lambda functions triggered by cloud watch events or API calls to automatically update route tables during a failover event.
An administrator is configuring an inline interface pair on a Cisco Secure Firewall Threat Defense device using Cisco FMC. The business requires that if the firewall experiences a power failure or kernel panic, traffic must continue to flow uninterrupted through the network segment. Which action should the administrator take?
Fail Open configuration ensures that if the hardware fails or loses power, the bypass capability physically connects the ports together to keep traffic flowing.
Why this answer
Hardware bypass capability (fail-open) on supported Network Interface Modules (NIMs/SMs) allows physical optical or copper paths to bridge automatically when power is lost or the Snort engine crashes.
Which TWO components must be configured to manage an FTD via the FMC?
Required for security/pairing.
Why this answer
Management requires configuring the management IP on the FTD and registering it with the FMC using a registration key.
An administrator is troubleshooting a Stateful High Availability (HA) pair of Cisco Secure Firewall 4100 series devices managed by FMC. The units are failing to form an HA state, and logs indicate a state mismatch on the control link. Which underlying cause is most likely preventing the HA synchronization?
FMC enforces strict version matching; even a minor patch level mismatch between primary and secondary units will cause HA initialization to fail.
Why this answer
Firewall High Availability requires identical hardware models, identical interface counts/types, matching deployment modes (routed/transparent), and identical software/patch versions.
An engineer is deploying Cisco Secure Firewall Threat Defense in a complex multi-zone routed environment. Which THREE design considerations apply when implementing routed mode interfaces? (Choose three)
Routed interfaces operate at Layer 3 with IP addresses.
Why this answer
Routed mode interfaces require IP addresses, participate in routing protocols or static routes, and handle MAC address rewriting as Layer 3 gateways.
You are configuring a static route on a Cisco Secure Firewall Threat Defense using FDM. Which parameters are strictly required to create a valid IPv4 static route?
Creating a static route requires defining the target network/mask and the gateway (next-hop IP or interface).
Why this answer
A valid static route requires a destination network (prefix/mask), and either a next-hop IP address or an egress outgoing interface.
An engineer is troubleshooting a passive NGIPS deployment where the Cisco Secure Firewall is connected to a switch SPAN port. Security analysts report that certain VLAN-tagged packets are not appearing in the event logs. What is the most likely cause?
If VLAN tags are present in the SPAN traffic, the passive interface must be configured to handle those VLANs to inspect the encapsulated packets.
Why this answer
When monitoring trunk ports via SPAN, if the firewall's passive interface is configured without VLAN tagging enabled or lacks subinterfaces matching the trunk VLANs, tagged frames may be dropped or ignored.
An engineer is deploying a Cisco Secure Firewall Threat Defense Virtual (FTDv) instance in an Amazon Web Services (AWS) VPC. The deployment requires the FTDv to inspect traffic crossing between public and private subnets. Which AWS architectural construct is mandatory for routing traffic through the FTDv instance?
AWS route tables must be modified to point traffic to the firewall instance's Elastic Network Interface (ENI) to ensure traffic flows through the virtual firewall.
Why this answer
In public cloud deployments like AWS, routing traffic through a firewall appliance requires updating AWS Route Tables to point default or specific subnet traffic to the Elastic Network Interface (ENI) of the firewall's internal/external interfaces.
An engineer is configuring static route tracking on a Cisco Secure Firewall Threat Defense to ensure high availability for outbound internet connectivity. A backup static route is configured with a higher metric. What mechanism does the firewall use to dynamically switch from the primary route to the backup route when the primary next-hop fails?
Static route tracking relies on IP SLA (ping/TCP monitors) or BFD to monitor availability and remove the primary route from the forwarding table upon failure.
Why this answer
Static route tracking utilizes Embedded Event Manager (EEM) or IP SLA monitoring (via ICMP/TCP probes) to track reachability, modifying the routing table dynamically when the probe fails.
Which TWO of the following are valid requirements for setting up an FTD high availability pair?
Matching hardware models is a mandatory requirement.
Why this answer
FTD HA requires both units to be the same model and the same software version to ensure compatibility.
Which THREE factors affect the choice between deploying FTD in Routed vs Transparent mode?
Placement dictates the mode.
Why this answer
Your need for L3 features (NAT, dynamic routing), network topology constraints, and existing IP infrastructure dictate the mode choice.
An engineer is deploying an NGIPS inline set across two physical interfaces. To prevent network disruption during maintenance, the engineer needs to ensure that if the firewall loses power or experiences a kernel panic, traffic can still traverse the physical link. Which hardware feature must the interfaces support?
Hardware bypass ports physically bridge the RX/TX paths when power or software fails, allowing uninspected traffic to pass.
Why this answer
Optical or copper bypass capability (hardware fail-open/fail-close bypass caps) allows traffic to pass physically through the ports when power is lost or the system crashes.
Which TWO of the following are required for FTD transparent mode deployment?
The BVI provides the L3 management entry point.
Why this answer
Transparent mode requires bridge groups to handle traffic, and an IP address on the BVI for management purposes.
An engineer deploys an NGIPS in passive mode using a SPAN (Switched Port Analyzer) port on a core switch. During traffic analysis, the engineer notices that the firewall is not seeing TCP reset packets generated by internal servers. What is the primary operational limitation of deploying an NGIPS in passive mode that explains this behavior?
Because passive sensors only monitor a copy of traffic, they cannot block live traffic inline.
Why this answer
Passive mode sensors receive a copy of traffic via SPAN or tap. Because they are out-of-band, they cannot block traffic inline or actively drop packets; they can only generate alerts or send TCP resets (if configured and supported), but cannot guarantee inline remediation.
An administrator is setting up a high availability pair of Cisco Secure Firewall devices. During the HA configuration wizard in FMC, the administrator is asked to provide a registration key. What is the purpose of this key?
The registration key serves as a shared secret to authenticate the HA peers when establishing the secure control link.
Why this answer
The registration key (shared secret) is used to securely authenticate and encrypt the initial communication channel between the primary and secondary units during the HA pairing process.
An engineer is deploying a Cisco Secure Firewall Threat Defense Virtual (FTDv) in Google Cloud Platform (GCP). The architecture requires multiple network interfaces. How does GCP map these interfaces during deployment?
GCP supports multi-NIC instances where nic0 is reserved for management and additional NICs handle internal and external data traffic.
Why this answer
GCP allows multiple Network Interface Cards (NICs) on a single compute instance, where nic0 is typically assigned for management and subsequent nic1, nic2, etc., are assigned for data traffic.
When configuring ECMP (Equal-Cost Multi-Path) on FTD, what happens if one of the next-hop paths fails?
ECMP re-calculates the path based on available routes.
Why this answer
FTD monitors the routes; if a path fails, the FTD removes that specific route from the routing table, and traffic is automatically redistributed across the remaining paths.
When deploying an FTD appliance, which interface role is used for receiving traffic from a SPAN port?
Passive interfaces are designed for monitoring.
Why this answer
A passive interface is configured to monitor traffic without being part of the production traffic path, making it perfect for SPAN/TAP input.
An administrator is managing high availability failover events for Cisco Secure Firewall Threat Defense devices using Cisco FMC. Which TWO actions or events will trigger a failover from the active unit to the standby unit? (Choose two)
Monitored interface failures can trigger an automated failover.
Why this answer
Failover is triggered by events such as hardware failure, loss of heartbeat on the failover/control link, or interface failure thresholds being exceeded.
When deploying an FTD virtual appliance in AWS, which feature allows the FTD to scale horizontally to handle varying traffic loads?
Cloud-native auto-scaling handles horizontal scaling.
Why this answer
In cloud environments, FTD virtual appliances can be deployed within an Auto Scaling group to handle dynamic traffic loads.
An administrator is configuring static route tracking on a Cisco Secure Firewall Threat Defense device managed by FMC. A tracked IP address becomes unreachable, and the primary static route is removed from the routing table. What mechanism does FTD use to verify the reachability of the tracked destination?
FTD uses IP SLA tracking objects that issue ICMP Echo or TCP probes to determine reachability.
Why this answer
Static route tracking in FTD uses IP SLA monitoring (ICMP Echo or TCP probes) to continuously test reachability and trigger failover to a backup route.
Which THREE of the following are necessary to configure an FTD in passive mode?
Passive interfaces should not have an IP address.
Why this answer
Passive mode requires an interface to be in a non-routing mode, typically using a SPAN port, and it does not allow for blocking traffic.
Which THREE of the following are valid requirements or characteristics when deploying Cisco Secure Firewall Threat Defense in a high availability (HA) configuration? (Choose three)
Software version consistency is mandatory for FTD HA formation.
Why this answer
FTD High Availability requires identical hardware/virtual models, the same software versions, and dedicated HA links.
Which deployment scenario represents the correct use case for deploying a Cisco Secure Firewall Threat Defense in passive NGIPS mode?
Passive mode monitors traffic via SPAN/tap out-of-band, avoiding latency or inline points of failure.
Why this answer
Passive NGIPS mode is used when monitoring traffic out-of-band via a tap or SPAN port without putting the device in the direct path of data flow.
Which FTD deployment mode must be selected to use the device as a transparent bump-in-the-wire for security inspection?
Transparent mode is the correct mode for bump-in-the-wire.
Why this answer
Transparent mode allows the FTD to be inserted into a network without changing the IP scheme, acting as a bridge.
You are configuring an active/standby High Availability pair for Cisco Secure Firewall Threat Defense using FMC. You need to configure port channels for the data interfaces to increase bandwidth and redundancy. Which guideline must be followed regarding port channels in an HA deployment?
HA units require symmetrical configurations, meaning port channels and their physical members must match precisely on both devices.
Why this answer
Port channel configurations (EtherChannels) must be identically configured on both the active and standby units. The physical member ports must match across both firewalls.
You are deploying a Cisco Secure Firewall Threat Defense in an existing core network as an out-of-band intrusion prevention system. Which NGIPS deployment mode should you configure to ensure the firewall performs deep packet inspection and generates alerts without dropping any production traffic in the event of a device failure or high load?
Passive mode receives mirrored traffic via SPAN/TAP and operates entirely out-of-band without interfering with the live traffic path.
Why this answer
Passive mode listens to a mirrored traffic stream (e.g., via SPAN or TAP). It analyzes copies of packets and cannot drop live production traffic.
You are deploying a high-availability pair of Firepower Threat Defense (FTD) units. Which TWO requirements must be met to ensure stateful failover functions correctly?
Software version parity is mandatory.
Why this answer
Stateful failover requires a dedicated link and matching hardware/software configurations.
You are troubleshooting high availability. The units are connected, but the failover link shows as 'Down'. What is the most likely cause?
Physical or configuration mismatch on the failover port prevents the link from forming.
Why this answer
The failover link must be a direct cable connection or a dedicated VLAN. Mismatched cable types or misconfigured link settings are common causes for the link to remain down.
An enterprise network design incorporates Equal-Cost Multi-Path (ECMP) routing across two Cisco Secure Firewall Threat Defense units functioning independently in routed mode. What is the primary benefit of enabling ECMP on the firewalls?
ECMP provides traffic load balancing across multiple equal-cost paths.
Why this answer
ECMP allows the firewall to install multiple equal-cost paths to the same destination in its routing table, distributing traffic across multiple next-hop routers for load balancing and redundancy.
When deploying an FTD cluster, which component is responsible for distributing traffic across the members of the cluster?
The external switch distributes traffic via EtherChannel (LACP) using hash-based load balancing.
Why this answer
In an FTD cluster, the control node (or a dedicated switch using EtherChannel) handles traffic distribution based on the configured load-balancing method.
An administrator is planning an Active/Standby High Availability deployment for two Cisco Secure Firewall Threat Defense devices managed by FMC. Which THREE prerequisites must be satisfied before configuring the HA pair? (Choose three)
A dedicated failover/control link is required between the peers.
Why this answer
HA deployment requires identical hardware models, matching major/minor FTD software versions, and dedicated physical or logical links for stateful failover control.
An engineer is configuring dynamic routing using OSPF on a Cisco Secure Firewall Threat Defense device managed by FMC. Which TWO configuration steps are required to establish an OSPF adjacency? (Choose two)
Enabling the OSPF process and defining areas in FMC is the first step.
Why this answer
OSPF setup on FTD requires enabling the OSPF process globally and configuring the specific interfaces within the area with correct parameters.
Which FTD command-line tool is primarily used to check interface status and physical link state?
This provides physical interface information.
Why this answer
The 'show interface' command provides detailed status on physical link state, speed, and duplex.
You are deploying a Cisco Firepower Threat Defense (FTD) unit in transparent mode. Which requirement must be met for the device to process traffic correctly in this mode?
Transparent mode interfaces act as a bump-in-the-wire and do not require IP addresses.
Why this answer
Transparent mode requires the FTD to be configured with a management IP address, but it acts as a Layer 2 device where interfaces do not require IP addresses for traffic forwarding.
In an FTD cluster, what happens if the cluster control link fails?
This prevents inconsistent traffic handling.
Why this answer
If the control link fails, the cluster members cannot synchronize state or status, typically leading to a split-brain scenario or the standby nodes disabling themselves to prevent inconsistency.
An administrator configures a Cisco Secure Firewall Threat Defense cluster. During normal operations, a data node experiences a critical hardware failure. What happens to the active connections currently processed by that specific failed data node?
Clustered devices share connection state information, allowing surviving nodes to absorb and maintain active flows upon node failure.
Why this answer
In a firewall cluster, connection states are shared or can be redistributed/failed over. When a data node fails, existing connections handled by that node are re-hashed or terminated unless state is synchronized across the cluster nodes.
You are deploying an FTD in a cloud environment and need to ensure high availability. Which technology is typically used to manage the virtual IP failover?
Updating route tables is the standard cloud method for failover.
Why this answer
Cloud providers (like AWS) do not support gratuitous ARP in the same way as physical switches. FTDv uses API calls to update the routing table or elastic IP to point to the new active instance.
Which of the following is a limitation when deploying an FTD in transparent mode?
Transparent mode is L2 and does not route.
Why this answer
Transparent mode does not support dynamic routing protocols (like OSPF or BGP) because it acts as an L2 bridge.
Which TWO of the following are required when configuring a static route with tracking?
Links the route to the monitor.
Why this answer
Static route tracking requires an SLA Monitor object to check reachability and a static route that references this monitor.
An administrator is setting up FTD HA. Which of the following is true regarding the configuration synchronization between the primary and secondary units?
The FMC serves as the single source of truth for the HA pair.
Why this answer
The FMC manages the configuration of the HA pair and pushes the same configuration to both units, ensuring they remain synchronized.
You are configuring an NGIPS mode deployment on an FTD device. You need to ensure that the FTD can drop malicious traffic in real-time. Which mode must you select?
Inline mode places the FTD in the traffic path, enabling dropping and resetting of connections.
Why this answer
Inline mode allows the FTD to actively inspect and drop packets, whereas passive mode only inspects traffic via a copy/span port and cannot drop packets.
Which TWO of the following are benefits of using a Port Channel on an FTD?
If one link fails, traffic continues on others.
Why this answer
Port channels increase aggregate bandwidth and provide physical link redundancy.
When using a Redundant Interface, what is the primary behavior during a link failure?
Redundant interfaces provide interface-level failover.
Why this answer
In a redundant interface pair, one link is active and the other is standby. If the active link fails, the FTD automatically switches to the standby link.
You have an FTD device and need to perform deep packet inspection without changing the network topology or IP addressing. Which deployment mode should you choose?
Transparent mode is invisible to existing L3 devices.
Why this answer
Transparent mode sits in the middle of a segment as a layer 2 bridge, requiring no changes to IP addressing or routing on the existing infrastructure.
An administrator is configuring a static route tracking mechanism on a Cisco Secure Firewall Threat Defense device using an ICMP Echo IP SLA object. What happens to the tracked static route if the SLA probe fails to receive a response?
When tracking detects failure, the static route is pulled from the routing table.
Why this answer
When an IP SLA probe fails, the tracked object changes its state to DOWN, causing the dependent static route to be removed from the routing table, allowing backup routes to take over.
An administrator is managing Cisco Secure Firewall Threat Defense devices using Cisco Defense Orchestrator (CDO). Which TWO capabilities does CDO provide for firewall deployment and management? (Choose two)
CDO offers cloud-based policy management and rule optimization.
Why this answer
CDO is a cloud-based management platform that provides policy management, configuration drift analysis, and bulk management across FTD and other Cisco security devices.
An administrator is configuring a new Cisco Secure Firewall Threat Defense in routed mode on Firepower Device Manager (FDM). During the initial setup, the administrator needs to define the routing behavior for a multi-zone deployment. Which configuration step is mandatory when setting up routed mode?
Routed mode requires Layer 3 IP addresses on interfaces and assignment to security zones to process traffic across different subnets.
Why this answer
In routed mode, every interface must belong to a security zone and possess an IP address. Routed mode operates as a Layer 3 hop, unlike transparent mode which operates at Layer 2.
Which THREE features must be configured to successfully implement static route tracking on an FTD device?
The track ID links the route to the probe state.
Why this answer
Static route tracking requires a monitor object, a tracking command associated with that monitor, and a static route that references the track ID.
Ready to test yourself?
Try a timed practice session using only Deployment questions.