75 of 94 questions · Page 1/2 · Management And Troubleshooting · Answers revealed
An administrator needs to determine if the FMC has enough disk space to hold a new software upgrade image. Which menu should they check?
The Health Monitor displays system resource utilization including disk usage.
Why this answer
The System Information page provides current disk utilization metrics for the FMC appliance.
An engineer has modified several access control rules and object groups on the FMC. Before deploying these changes to the FTD, the engineer wants to review all pending changes to ensure no unauthorized modifications are included. Where in the FMC GUI should the engineer go to view pending deployment changes?
Clicking Deploy opens the deployment dialog where administrators can select devices and review a line-by-line diff of pending changes.
Why this answer
Pending changes on the FMC are reviewed by navigating to Deploy > Deployment (or clicking the Pending Changes icon/button in the top right banner).
An administrator is troubleshooting a memory leak on an FTD virtual appliance. The administrator wants to inspect real-time memory usage of individual system processes and identify top memory-consuming tasks. Which command should be run in the FTD expert mode shell?
Standard Linux utilities like 'top' and 'ps' are available in the expert shell to analyze process memory and CPU usage.
Why this answer
In standard Linux expert mode on FTD, standard process monitoring commands like 'top' or 'htop' (if installed) or specialized memory scripts are used. Specifically, 'top' or 'ps aux --sort=-%mem' displays active process memory consumption.
An administrator is troubleshooting a packet drop issue on a Firepower Threat Defense (FTD) device managed by Firepower Management Center (FMC). The administrator wants to inspect real-time packets entering and leaving specific interfaces including layer 2/3 headers and ASP drop details. Which built-in FMC feature should the administrator use?
Packet captures on FTD are configured under Devices > Device Management, editing the device, and navigating to the Packet Capture tab.
Why this answer
The Capture feature on FMC allows administrators to configure packet captures on FTD interfaces, specifying filters, matching criteria, and inspecting drop reasons via the Associated Drop inspection or Advanced Settings.
An administrator needs to restore an FMC configuration backup onto a replacement hardware appliance. Which of the following conditions must be met for the backup restoration to succeed successfully?
FMC backup and restore operations require exact software version matching between the source and target appliances.
Why this answer
FMC backups require the target appliance to run the exact same version of software and have matching or compatible network configurations (like license entitlements and serial structures) to ensure a clean restoration.
An administrator is troubleshooting a high availability (HA) failover link failure between two FTD physical appliances. Which THREE checks should be performed to diagnose physical and logical connectivity between the failover interfaces? (Choose three)
Physical layer verification is the first step in troubleshooting link failures.
Why this answer
Troubleshooting HA failover links involves checking physical cable connections, verifying interface status via 'show failover', checking IP reachability/ping across the failover interface, and reviewing failover configuration parameters.
When troubleshooting a connectivity issue where traffic is being dropped, which TWO of the following logs or tools should be reviewed first to determine the cause?
Shows the policy rule that acted on the traffic.
Why this answer
Connection events show the policy hit, and the packet tracer tool shows how the policy processing pipeline handles the specific traffic flow.
An administrator notices that the FMC Health Monitor shows a 'Critical' alert for the Snort process utilization on an FTD device. What is the most appropriate first-line troubleshooting step from the FMC GUI or FTD CLI to investigate the cause of high Snort CPU usage?
FMC provides Snort performance statistics under Device Management to see per-core usage, packet processing rates, and dropped packets due to overload.
Why this answer
Analyzing inspection performance metrics, packet rates, and specific traffic patterns via FMC or running 'show perf-stat' or 'top' on the FTD CLI helps identify whether specific rules or traffic spikes are causing Snort queuing.
An administrator wants to view system status and resource metrics directly on an FTD CLI without logging into the FMC. Which TWO commands are commonly used in the FTD diagnostic CLI or expert shell for this purpose? (Choose two)
The Linux 'top' command displays real-time process resource consumption.
Why this answer
On FTD, 'show resource usage' or 'show memory' in the diagnostic CLI and 'top' in the expert shell provide resource metrics.
An administrator is preparing to upgrade an FTD managed device using the FMC. Before initiating the upgrade, which FMC utility should be run to check for compatibility, disk space, and potential configuration blocks?
The Check Compatibility / Readiness check utility within System > Updates verifies disk space, model support, and prerequisite versions before an upgrade.
Why this answer
The System Diagnostics or the Upgrade Verification Tool / Software Upgrade readiness check built into FMC is designed to validate compatibility and prerequisites before performing upgrades.
An administrator is troubleshooting an issue where an FMC cannot communicate with a managed FTD device. The health monitor shows registration is down. The administrator checks the FTD CLI and verifies the registration key and NAT ID. Which log file on the FTD should the administrator examine to troubleshoot registration and communication daemon errors (such as sftunnel)?
The sftunnel log file tracks secure tunnel establishment, certificate handshakes, and heartbeat messages between FTD and FMC.
Why this answer
The sftunnel daemon manages secure communication between FTD and FMC. Its logs are located in /var/log/cisco/sftunnel.log on the FTD filesystem.
An engineer needs to troubleshoot connectivity through an FTD firewall and wants to use the FTD packet tracer utility. Which THREE parameters are required when executing a basic packet tracer command from the diagnostic CLI? (Choose three)
Protocol specification is mandatory for packet-tracer.
Why this answer
The packet-tracer syntax requires specifying the ingress interface, protocol (tcp, udp, icmp), source IP, source port (for tcp/udp), destination IP, and destination port.
An administrator is troubleshooting connectivity issues to the FMC web interface (HTTPS). Which TWO commands or diagnostic checks can be performed on the FMC CLI to verify web server responsiveness and port status? (Choose two)
Restarting or checking the web server process daemon verifies web interface operational status.
Why this answer
On the FMC CLI, administrators can check the status of web services using netstat/ss to verify port 443 binding, and examine lighttpd or nginx web server processes.
An FMC managed deployment is experiencing slow GUI performance and delayed event reporting. The administrator suspects database table bloat in the FMC PostgreSQL database. Which utility or command can the administrator run from the FMC expert shell to analyze and vacuum/optimize the database safely?
FMC includes internal database maintenance utilities managed via support scripts to safely vacuum PostgreSQL tables.
Why this answer
FMC provides specialized database maintenance scripts, such as 'sfdblist' or database optimization tools located in /usr/local/sf/bin/ or invoked via specific admin CLI utilities.
An FTD high-availability pair is experiencing split-brain behavior due to a unidirectional failure of the state and heartbeat links. As a result, both units are claiming to be Active. Which CLI command on the FTD should an administrator use to troubleshoot interface failover status and verify interface health across the failover link?
'show failover' provides detailed status on unit roles, mate status, state links, and interface health.
Why this answer
To check failover status and health on an FTD device, administrators use the diagnostic CLI command 'show failover' or 'show failover history'.
An engineer deploys an Access Control Policy change from the FMC to a managed FTD device. The task hangs in the Deployment History with a status of 'Applying' for an extended period. Upon checking the FTD CLI, the engineer notices a locked deployment file or stuck process. What action should be taken to clear or restart the deployment process safely?
The Task Monitor allows administrators to cancel stuck tasks, and checking pending changes prevents duplicate deployment locks.
Why this answer
If a deployment hangs, administrators can check deployment status, cancel or restart the deployment daemon (sfims) or use the task manager in FMC to cancel the task. On the FTD, checking the deployment status or restarting management services may be required.
An administrator notices that health alerts from managed FTD devices are not appearing in the FMC health monitor, although traffic logs are updating normally. Which service or daemon on the FMC is primarily responsible for collecting and processing health and performance metrics from managed devices?
The healthd daemon on FMC is responsible for collecting, aggregating, and processing health monitor data from managed devices.
Why this answer
The sftunnel daemon manages communication between FMC and FTD for control traffic, while specific health daemons handle metrics. Specifically, the 'healthd' process on FMC processes health monitoring data.
An administrator needs to troubleshoot an issue where legitimate traffic is being silently dropped by the FTD device. The standard packet trace does not reveal the exact reason. Which command executed on the FTD CLI is best suited to diagnose accelerated security path (ASP) drops in real time?
Capturing type asp-drop all on the FTD CLI allows the firewall to intercept and display packets dropped by the ASP mechanism along with the specific drop reason string.
Why this answer
The command 'capture drop type asp-drop' or monitoring ASP drop counters using 'show asp drop' helps identify packets dropped by the accelerated security path due to ACLs, spoofing, or exhausted resources.
An administrator wants to configure automated backup generation on the FMC and ensure that backup archives are securely offloaded to a remote server. Where is this configured in the FMC GUI?
Backup schedules, manual backup generation, and remote storage locations are managed under System > Tools > Backup / Restore.
Why this answer
System > Tools > Backup/Restore allows administrators to configure scheduled automated backups and define remote storage locations such as SFTP servers.
An administrator notices that health monitors on the FMC show a critical warning for high disk utilization on the /var partition of an FTD device. What is the safest and most standard method to resolve disk space exhaustion caused by accumulated core files and rotated logs on FTD?
Clearing core files and old logs safely frees space on the /var partition without affecting active configurations.
Why this answer
The command 'system support purge log' or clearing rotated logs and core files via expert mode is used, but specifically, FMC allows administrators to manage and delete core files and rotated logs safely through the FTD CLI or FMC device management settings.
An administrator needs to restore an FMC configuration from a previously saved backup file. Where in the FMC GUI is the Backup/Restore utility located?
System > Tools > Backup/Restore is the exact menu path for creating and restoring FMC backups.
Why this answer
FMC backup and restore operations are managed centrally under System > Tools > Backup/Restore.
An engineer needs to analyze the connection history and security events from an FTD device that occurred three weeks ago. However, when querying the FMC event viewer, the events are missing. What is the most likely cause of this behavior?
FMC purges old events based on database retention policies and storage limits.
Why this answer
FMC event databases have configurable retention policies and disk space thresholds. If event retention settings are low or disk space fills up, older events are automatically purged to prevent disk exhaustion.
An administrator needs to monitor the real-time health and status of managed devices from the FMC dashboard. Which TWO dashboard widgets or features are available in FMC to assist with device monitoring? (Choose two)
The Health Status widget highlights CPU, memory, disk, and hardware health across managed devices.
Why this answer
FMC provides customizable dashboards with widgets such as Device Status, Health Status, Connection Events, and System Notices.
An administrator is preparing to perform a system backup on the FMC. Which TWO data categories can be optionally included or excluded when generating the backup? (Choose two)
Certificates and licensing tokens are part of system settings that can be managed in backups.
Why this answer
FMC backup configuration allows selecting whether to include event data and historical data, as well as configuration files, health data, and certificates.
Which action must be taken on the FTD CLI after a manual configuration change is made, if you want to ensure the FMC does not overwrite it?
The FMC manages the configuration and will overwrite out-of-band CLI changes.
Why this answer
Manual CLI changes are generally discouraged because the FMC will overwrite them during the next deployment. The best practice is to always perform changes via the FMC.
Which license state must an FTD device reach to allow the FMC to push policy configurations to it?
A licensed state is a prerequisite for policy application.
Why this answer
Devices must be registered and properly licensed (or in grace period) for policy deployment to succeed.
An administrator needs to perform a full system backup of the FMC. Where is the most appropriate place to store this backup for long-term disaster recovery?
Remote storage is best practice for disaster recovery.
Why this answer
Backups should be stored on a remote server (e.g., via SCP or FTP) to ensure they are available if the FMC appliance fails entirely.
An administrator needs to verify if an FTD is correctly receiving updates from the Cisco Support Cloud. Which menu path shows the status of rule updates and threat intelligence feeds?
Product Updates is where rule and vulnerability database updates are monitored.
Why this answer
Updates are managed under the 'Updates' section of the 'System' menu, where you can view update history and current versions.
An administrator is troubleshooting a scenario where Snort inspection threads on an FTD are crashing intermittently, producing core dumps. To assist Cisco TAC in root cause analysis, what is the correct sequence of tools or CLI commands to collect the necessary diagnostic data?
The 'system support tech-support' command collects all logs, core dump metadata, and system state required by TAC.
Why this answer
Cisco provides a dedicated troubleshooting bundle generation tool on both FMC and FTD. On the FTD CLI, running 'system support diagnostic-cli' or generating a tech-support file via 'system support tech-support' collects core dumps, logs, and system metrics.
An administrator wants to check the status of all software processes running on an FMC appliance (such as the web server, database, and event handlers) to ensure everything is running smoothly. Which command should be run in the FMC CLI?
pmtool is the standard Cisco Firepower utility to check, start, and stop internal application processes.
Why this answer
The 'pmtool status' command is used across Cisco Firepower appliances to check the status of internal process manager (pm) daemons and services.
An administrator is analyzing a troubleshooting scenario involving Snort inspection crashes on an FTD device. Which THREE locations or tools should the administrator check to diagnose why the Snort process restarted or crashed? (Choose three)
OOM killer logs in /var/log/messages indicate if the kernel terminated Snort due to high memory consumption.
Why this answer
Snort crashes leave traces in /var/log/messages, core dump directories (/var/crash or specific core locations), and Snort specific log files in /var/log/snort/.
An administrator successfully restores an FMC backup onto a freshly deployed FMC virtual appliance of the exact same software version. However, after the restore completes, all managed FTD devices show a status of 'Offline' or 'Config Apply Failed'. What is the most likely root cause and correct resolution?
Restoring to a new appliance generates a new appliance ID/CA, breaking the secure registration channel until re-established.
Why this answer
When restoring an FMC backup to a new appliance, the Internal CA (Public/Private keys) changes unless it is a bare-metal restore using the exact same hardware UUID or proper registration re-establishment. Often, registration keys must be re-configured or mutual TLS certificates synchronized because the new FMC instance has a different registration identity.
An FMC administrator needs to back up configuration data and event data for disaster recovery. Which backup type includes both system configurations and historical event data stored in the database?
FMC allows administrators to include event data in manual system backups, though it is excluded by default due to size.
Why this answer
A manual or scheduled backup in FMC can be configured to include event data, but standard system backups typically separate configuration and events because event databases are extremely large. However, the system allows full backups that include event data when explicitly selected.
An administrator needs to schedule automated weekly backups of the FMC configuration and store them securely on a remote SCP server. Where is remote backup storage configured in the FMC GUI?
Remote storage destinations for backups are configured under the Backup / Restore menu.
Why this answer
Remote storage locations for backups (such as FTP, SFTP, SCP) are configured under System > Tools > Backup / Restore > Remote Storage Settings.
During a routine backup of the FMC, the administrator wants to ensure that the generated backup file contains critical historical events, configurations, and intrusion event data so that it can be fully restored to a replacement appliance if necessary. Which backup type should be selected in the FMC?
Selecting both settings ensures configuration and event tables are preserved in the backup tarball.
Why this answer
FMC provides 'Manual Backup' configurations where administrators can select components. To include configuration and event data, a manual backup profile must be created with both System Configuration and Event data selected.
An administrator is troubleshooting a policy deployment failure from the Firepower Management Center (FMC) to a managed Firepower Threat Defense (FTD) device. The deployment hangs at 33 percent with an error related to snort synchronization. Which tool should the administrator use on the FTD CLI to examine the real-time Snort rule compilation and policy application process?
The process manager (pm) and Snort logs on the FTD CLI show exact synchronization and compilation errors during deployment.
Why this answer
The system support ftw command or tailing the /var/log/messages and /var/log/pm/pm.log files along with examining snort compilation logs provides deep insight into deployment failures. Specifically, monitoring the deployment task manager and pm logs reveals why snort synchronization hangs.
An administrator is preparing an upgrade plan for an FMC and its managed FTD devices. Which THREE best practices should be followed during the upgrade process to minimize downtime and avoid failure? (Choose three)
Backups ensure recovery capability if an upgrade fails.
Why this answer
Best practices include reading release notes for upgrade paths, taking backups before upgrading, running pre-upgrade checkers, and upgrading FMC before FTD devices.
During an upgrade of an FTD device managed by FMC, the pre-checks fail because of insufficient disk space in the target upgrade partition. Which CLI command sequence should the administrator use to safely clean up previous upgrade installation files and temporary packages?
This command safely purges old upgrade installers and temporary files to reclaim space for new upgrades.
Why this answer
FTD upgrade installation packages are stored in specific directories. The command 'system support installer cleanup' is the built-in utility designed to safely remove leftover upgrade files and temporary install artifacts.
When troubleshooting FTD policy deployment, which THREE of the following are common reasons for a deployment to fail?
Heavy policies may exceed available memory during compilation.
Why this answer
Resource constraints, connectivity issues, and configuration conflicts are the most frequent causes of failed deployments.
An administrator wants to export a packet capture (.pcap file) taken on an FTD interface directly from the FMC GUI for offline analysis in Wireshark. Where should the administrator navigate?
FMC allows configuring, running, and downloading packet captures via the Device Management or Analysis capture menus.
Why this answer
Packet captures taken on FTD devices can be managed and downloaded directly from the FMC GUI under Analysis > Captures or Devices > Device Management > Packet Capture.
An FTD device is dropping packets unexpectedly. An engineer runs a packet tracer via the FTD diagnostic CLI using 'system support diagnostic-cli' and enters the command: 'packet-tracer input inside tcp 192.168.1.50 12345 10.0.0.5 80'. The output shows a drop at the 'Access-Rule' phase with the action 'DROP'. What does this indicate?
The Access-Rule phase evaluates ACP rules; a drop here means an explicit blocking rule matched.
Why this answer
A packet tracer drop at the Access-Rule phase with a drop action indicates that an Access Control Policy rule matched the traffic and explicitly dropped or rejected it.
An engineer is troubleshooting a packet capture configuration on an FTD device managed by FMC. Which THREE statements regarding FTD packet capture behavior and limitations are correct? (Choose three)
Capturing decrypted traffic or using specific filters allows viewing decrypted payloads on the terminating device.
Why this answer
FTD packet captures can capture ingress/egress, have buffer size limits, and can utilize access control lists or filters, but they cannot capture encrypted payload content post-decryption unless terminated on the box.
An administrator wants to ensure that packet captures taken on an FTD can be analyzed easily. Which TWO ways can packet capture files (.pcap) be retrieved from the FMC? (Choose two)
FMC provides a direct download link for completed packet capture files.
Why this answer
FMC allows administrators to download packet capture files directly through the GUI via Devices > Device Management > Packet Capture or view them in real-time.
An FTD device managed by FMC is experiencing high CPU utilization attributed to the Snort inspection engine. The administrator wants to identify which specific intrusion rules or access control rules are consuming the most resources. Which tool or report should the administrator use?
FMC Intrusion Performance dashboards and CLI perfstats provide granular details on rule processing overhead.
Why this answer
The Performance Statistics feature and Intrusion Event analysis in FMC help identify resource-heavy traffic and rules. Additionally, the 'Show Snort Statistics' or 'Perfstats' command via the FTD diagnostic CLI provides real-time rule processing metrics.
An engineer needs to troubleshoot intermittent packet loss between an FTD inside interface and a destination server. The engineer runs the 'packet-tracer' command on the FTD CLI. What limitation must the engineer keep in mind regarding packet-tracer?
Packet-tracer is a simulation utility that traces virtual packets through the access control and inspection engines.
Why this answer
Packet-tracer simulates packet processing through the firewall engine and Snort, but it does not actually transmit a real packet onto the physical wire, meaning it is a simulation tool.
An administrator is troubleshooting a scenario where configuration deployment from FMC to an FTD device fails with a 'Deployment Validation Error'. Where can the administrator view the detailed validation messages and deployment task history?
Task Manager tracks all FMC operations, including detailed logs of configuration deployments and error causes.
Why this answer
Deployment status, task history, and detailed error logs are available under Message Center or System > Monitoring > Task Manager in the FMC.
When troubleshooting FTD high memory or CPU usage, an administrator can gather diagnostic data directly from the appliance. Which THREE commands can be executed on the FTD CLI to analyze resource utilization? (Choose three.)
'show memory' provides overall and per-process memory consumption details on the FTD appliance.
Why this answer
Useful FTD CLI commands for resource troubleshooting include 'top', 'show cpu detail', and 'show memory', which display process-level utilization and system resource consumption.
An administrator needs to verify the license status and active feature subscriptions (such as URL Filtering, Malware, and IPS) on an FMC. Where should the administrator check this information in the FMC GUI?
Smart Licensing status, feature tokens, and authorization states are managed under System > Licenses.
Why this answer
License management and feature activations on the FMC are located under System > Licenses > Smart Licenses.
An administrator is preparing to troubleshoot a complex routing and NAT issue on an FTD device using packet tracer. Which TWO statements regarding the FTD packet tracer tool are correct? (Choose two.)
Administrators can run packet traces directly from the FMC troubleshooting tools menu or via the FTD CLI 'packet-tracer' command.
Why this answer
Packet tracer simulates traffic flow through the FTD, allowing administrators to test policies, NAT, and routing without sending live packets, and can be executed via both FMC and FTD CLI.
You are analyzing connection events and notice a block action. Which field in the connection event details best explains why the connection was dropped by the policy?
The Reason field indicates the specific cause, such as 'Security Intelligence' or 'Access Control Rule'.
Why this answer
The 'Reason' or 'Action' field in the connection event details provides the specific policy or inspection rule that caused the drop.
An administrator needs to troubleshoot a routing issue on an FTD device managed by FMC. Where in the FMC GUI should the administrator navigate to view and modify static and dynamic routing configurations for the device?
Device-specific settings like static routes, OSPF, and BGP are configured under the Routing tab of the device settings.
Why this answer
Routing configurations for FTD are managed under Devices > Device Management, selecting the specific device, and clicking the Routing tab.
An administrator wants to configure automated email notifications from the FMC whenever a critical health monitor alert occurs on any managed device. Where should this be configured in the FMC GUI?
Alert Responses under Health Monitor allow administrators to define email and SNMP notifications for health events.
Why this answer
Alert responses, SNMP traps, and email notifications for health monitoring are configured under System > Health > Monitor > Alert Responses.
An FTD device is failing to register with the FMC. The administrator confirms connectivity via ping. Which CLI command should the administrator run on the FTD to verify the registration status and the shared secret handshake?
This command displays the FMC registration state and connection details.
Why this answer
The 'show manager' command displays the registration status, the FMC IP, and whether the connection is currently established or pending.
Which tool in the FMC allows you to view the real-time flow of packets being processed by the Snort engine for troubleshooting purposes?
Packet Tracer provides a visual trace of policy and inspection hits.
Why this answer
Packet Tracer is the primary GUI tool for simulating and tracing traffic through the FTD inspection pipeline.
An administrator is setting up health monitoring alerts on the FMC. Which TWO notification methods can be configured when a health alert is triggered? (Choose two)
Health alerts can be sent via email to administrators.
Why this answer
FMC health monitor alert responses support sending email notifications and generating SNMP traps.
An administrator is performing a backup and restore operation on an FMC appliance. Which THREE statements are correct regarding the FMC restore process? (Choose three)
A restore operation replaces current database entries with the backup archive's contents.
Why this answer
When restoring an FMC backup, the target appliance must generally be running the exact same software version, the restore process overwrites existing configurations, and it requires proper system initialization.
An administrator is troubleshooting an issue where Snort inspection engine crashes repeatedly on an FTD device. Which THREE diagnostic artifacts or steps should the administrator collect and perform to assist Cisco TAC in resolving the core dump issue? (Choose three)
Core dumps contain the exact memory state at the moment of the crash.
Why this answer
When Snort crashes, core dump files are generated in /var/common/ or /var/sf/cores/. Collecting core files, tech-support bundles, and verifying Snort configuration rules helps TAC.
An administrator is configuring automated backup tasks on the FMC. Which TWO destinations or protocols are natively supported by the FMC for storing backup archives? (Choose two)
Backups can be stored locally on the FMC disk.
Why this answer
FMC supports local storage on the appliance as well as remote storage via SCP, FTP, and SFTP.
An administrator is troubleshooting high memory utilization on an FMC appliance. Which TWO actions or tools can be used to identify resource-heavy processes or clean up storage? (Choose two)
The Health Monitor provides detailed historical graphs of memory utilization.
Why this answer
On FMC, administrators can check process resource utilization using Linux top/ps via expert mode or review the Health Monitor. Cleaning up disk space and checking logs are standard troubleshooting steps.
When configuring FMC backup schedules, which TWO storage options are natively supported for the backup files?
SCP is a supported, secure protocol for offloading backups.
Why this answer
FMC supports local storage (to the management appliance) and remote storage via SCP or FTP/SFTP.
When troubleshooting policy deployment failures, which log file on the FMC should be examined to see the specific error returned by the device during the commit process?
The deployment history logs contain the granular errors from the device during policy push.
Why this answer
The task queue and the deployment history log contain details regarding why a deployment to a managed device failed.
When troubleshooting an issue where an FTD interface is in a 'down' state, which command helps verify if there is a physical layer issue or an administrative shutdown?
This provides the operational status and administrative state of the interface.
Why this answer
The 'show interface' command displays both the physical status and the administrative status of the interface.
An administrator is preparing to upgrade an FMC and its managed FTD devices from version 6.6.x to 7.2.x. What is the mandatory prerequisite regarding upgrade paths and compatibility checks?
The URT is a mandatory pre-upgrade utility that scans the database and configurations for blocking issues before upgrading.
Why this answer
Cisco mandates running the FMC Upgrade Readiness Tool (URT) before performing any major version upgrade to identify schema, database, or configuration incompatibilities.
An FTD high availability pair experiences a failover due to a hardware failure on the active unit. After the standby unit takes over, the administrator notices that existing TCP connections were dropped and did not state-fully fail over. What configuration setting should the administrator verify?
Stateful failover requires an active, low-latency failover link to synchronize connection states between units.
Why this answer
Stateful failover in FTD requires properly configured State MAC and Failover interfaces. If stateful failover is not enabled or if the failover link is down, long-lived or active TCP states are not synchronized to the standby unit.
Which THREE commands are valid for gathering information about the FTD's current status and health from the CLI?
Provides a summary of configured interfaces.
Why this answer
These commands provide insight into hardware, processes, and network state.
An FMC high availability (HA) pair has split-brain symptoms due to a management network failure. After restoring network connectivity, the standby unit remains in a 'Failed' state and does not automatically re-synchronize. What is the correct procedure to recover the HA sync?
Breaking and re-establishing the HA pair ensures a clean database sync from the active FMC to the standby.
Why this answer
When FMC HA encounters persistent sync issues after network restoration, the administrator must break the HA relationship and re-establish it, or use the system-level HA synchronization tools to force a re-sync from active to standby.
You are troubleshooting high CPU utilization on an FTD device. Which tool should you use to identify which specific process (e.g., snort) is consuming the most resources?
This command identifies individual process CPU consumption.
Why this answer
The 'show cpu usage' command provides a breakdown of resource usage, and 'show processes cpu-usage' provides process-specific detail.
An administrator is troubleshooting asymmetric routing issues across an FTD firewall using the FMC connection events and FTD CLI. The administrator wants to disable TCP state bypass or adjust TCP normalization settings to allow non-synchronized SYN packets through for a specific application. Where are TCP normalization and stateful inspection parameters configured for FTD?
Platform Settings policies contain global inspection, TCP normalization, and stateful bypass configurations.
Why this answer
TCP normalization, stateful inspection settings, and TCP bypass options are configured under Platform Settings policy applied to the FTD device.
An administrator is preparing to upgrade a high-availability (HA) pair of Firepower Threat Defense devices managed by an FMC. Before initiating the upgrade task via the FMC upgrade tool, which preliminary action is mandatory to ensure a seamless process and prevent split-brain conditions?
Running the pre-upgrade health check and installer verification prevents failed upgrades due to known blockers.
Why this answer
Before upgrading an HA pair, the administrator must verify that health monitors show green, check available disk space, and often it is recommended to ensure both units are synchronized, but specifically, running the pre-upgrade checker script via the FMC system update page is mandatory to flag blocking issues.
An administrator is investigating an issue where connection events are failing to reach the FMC from a managed FTD. Which THREE daemons or logs on the FTD and FMC should be checked to troubleshoot event transport and communication issues? (Choose three)
SFIMS and event streaming processes handle generating and forwarding connection records.
Why this answer
Event transport relies on processes like msg, sftunnel, and connection streaming daemons. Checking /var/log/cisco/sftunnel.log and event collection logs helps isolate the problem.
An engineer is troubleshooting a newly deployed FTD device where syslog messages are not reaching the external syslog server. Which tool on the FTD CLI can the engineer use to verify if the syslog generation and transmission process is attempting to send packets out the management or data interface?
Running a packet capture on the FTD CLI filtering for the syslog server IP confirms whether syslog packets are being generated and sent.
Why this answer
The 'system support syslog-ng' configuration and debugging tools or packet captures on the management interface verifying UDP port 514 traffic help troubleshoot syslog issues. Specifically, packet captures or debugging the logging subsystem.
An administrator notices that the Firepower Management Center (FMC) health monitor shows a critical warning regarding high disk utilization on the /var partition. Which built-in utility or action should the administrator perform first to safely free up disk space without disrupting critical database integrity?
Pruning old event data or removing stale packet captures directly reduces the /var disk utilization safely.
Why this answer
Clearing out rotated and old core dumps or troubleshooting via the system CLI using specialized scripts or purging old event data through the FMC GUI is standard. The df -h and du commands help locate space, but FMC provides specific maintenance tools to prune old events safely.
An engineer suspects that asymmetric routing is causing packets to be dropped by the FTD firewall. Which command should the engineer run on the FTD CLI to check for dropped packets and view drop reasons in real time?
This utility allows tracing the packet through the inspection engine to identify exact drop points and reasons such as asymmetric routing.
Why this answer
The command 'system support firewall-engine-debug' allows capturing packet flow and seeing exact drop reasons, but for real-time drop statistics, 'show asp drop' (inherited from ASA lineage) or examining packet tracer output is used. On FTD, packet tracing and drop debugs are standard.
Which THREE items are included in an FMC backup archive?
Essential for restoring operational state.
Why this answer
An FMC backup typically includes the system configuration, policies, and the database, but excludes event data to keep file sizes manageable.
An administrator wants to verify the NTP synchronization status and time offset on a managed FTD device from the FMC GUI. Where can this health and system information be viewed?
Device details and Platform Settings show device time synchronization and NTP configurations.
Why this answer
System settings such as NTP, time zone, and DNS are viewed and configured under Devices > Device Management, selecting the device, and looking at the Device Details or Platform Settings.
Ready to test yourself?
Try a timed practice session using only Management And Troubleshooting questions.