scenario questions

An administrator configures DNS injection and rewriting in a manual NAT rule on an FTD device. What is the primary purpose of enabling DNS translation in a NAT rule?

An administrator needs to determine if the FMC has enough disk space to hold a new software upgrade image. Which menu should they check?

An engineer has modified several access control rules and object groups on the FMC. Before deploying these changes to the FTD, the engineer wants to review all pending changes to ensure no unauthorized modifications are included. Where in the FMC GUI should the engineer go to view pending deployment changes?

A network security engineer is configuring an FTD device managed by FMC to inspect traffic traversing a site-to-site VPN. The engineer wants to apply intrusion prevention and malware inspection to traffic destined to an internal web server. The traffic is already allowed by an access control rule. Which configuration step is required to ensure the traffic is inspected?

An administrator is configuring a new Cisco FTD device in FMC and needs to ensure that the device can communicate with the FMC for management and policy deployment. Which interface type must be configured on the FTD to allow FMC management?

When configuring an Access Control Policy on the FMC, what is the purpose of the Default Action set at the bottom of the rules table?

You are deploying a Cisco Secure Firewall Threat Defense in transparent mode. How are frames forwarded between the internal and external interfaces of the firewall?

Which TWO statements are true regarding NGIPS passive mode deployment?

An administrator is configuring Security Intelligence feeds on the FMC. Which TWO types of objects or feeds can be used to populate Security Intelligence blacklists? (Choose two)

You need to map internal users to specific security policies based on their AD group membership. What must be configured in FMC to support this?

An administrator is deploying a new Cisco FTD device managed by FMC and needs to route traffic between two internal networks while performing NAT. The FTD must also enforce access control and inspection policies. Which interface mode must be configured on the FTD to meet these requirements?

A security team is deploying a Cisco Secure Firewall Threat Defense device in a data center where the requirement is to inspect traffic flowing between two Layer 3 segments without changing the IP addressing or routing of those segments. The firewall must sit logically between the two segments and forward traffic based on MAC addresses. Which deployment mode should be used?

When deploying an FTD virtual appliance on-prem using VMware ESXi, which virtual network adapter type is recommended for optimal performance?

An engineer is configuring a Cisco Secure Firewall Threat Defense cluster in a data center. To ensure high availability and prevent split-brain scenarios, what is the specific function of the cluster control link (CCL)?

An administrator is planning the deployment of a Cisco Secure Firewall Threat Defense device and needs to choose between routed mode and transparent mode. Which factor strongly favors choosing transparent mode?

An engineer is deploying a Cisco Secure Firewall Threat Defense device in a routed environment where the inside network uses private RFC 1918 addressing and the outside interface receives a dynamic address from the ISP. The requirement is to allow inside hosts to reach the internet without exposing their private addresses, while preserving the ability to add static translations later. Which deployment configuration should be used?

What action should you take if you want to test a new Access Control Rule without impacting production traffic?

An engineer is configuring an Identity Policy in FMC to enforce user-based access control. Active Directory integration has been established via User Agent, but the engineer notices that some users authenticated via remote access VPN are not being resolved to their IP addresses. Which feature must be integrated into the identity configuration to capture IP-to-user mappings for remote access VPN users?

An FTD device is configured in routed mode. What must be configured to allow traffic to exit the network through the firewall?

You are configuring a high availability pair of FTDs. Which interface type is strictly reserved for state synchronization?

Which tab in the Access Control Policy rule editor allows you to specify the source and destination zones?

You need to configure link redundancy on a Cisco Secure Firewall Threat Defense pair using EtherChannel (Port Channel) across multiple physical interfaces. When configuring LACP (IEEE 802.3ad) for the port channel interface via the Firepower Management Center (FMC), which requirement must be met for successful negotiation?

An administrator is configuring a Cisco FTD device in a high-availability pair managed by FMC. Which TWO statements about the failover link are correct? (Choose two.)

You are configuring an SSL Decryption policy. Which action is required to ensure that traffic to a specific financial website is excluded from inspection due to compliance reasons?

An administrator needs to restore an FMC configuration backup onto a replacement hardware appliance. Which of the following conditions must be met for the backup restoration to succeed successfully?

An administrator is troubleshooting a high availability (HA) failover link failure between two FTD physical appliances. Which THREE checks should be performed to diagnose physical and logical connectivity between the failover interfaces? (Choose three)

When troubleshooting a connectivity issue where traffic is being dropped, which TWO of the following logs or tools should be reviewed first to determine the cause?

An administrator notices that the FMC Health Monitor shows a 'Critical' alert for the Snort process utilization on an FTD device. What is the most appropriate first-line troubleshooting step from the FMC GUI or FTD CLI to investigate the cause of high Snort CPU usage?

Which component is responsible for processing traffic in an FTD cluster when 'Distributed' mode is used?

An administrator is troubleshooting an active/standby Cisco Secure Firewall High Availability pair. Stateful failover is enabled, but active long-lived TCP connections are dropping when a failover occurs. Upon checking the stateful inspection settings, what is the most likely cause of this behavior?

When configuring an FTD cluster, what is the purpose of the Control Plane IP address?

Which THREE methods can be used to populate IP address objects or groups in the FMC Object Management? (Choose three)

When configuring a NAT rule, which THREE options are valid 'Type' selections within the NAT Rule editor?

Where do you define the 'Search' criteria for finding objects in FMC?

A security administrator has integrated Cisco Secure Firewall Management Center (FMC) with Cisco Identity Services Engine (ISE) using pxGrid. The administrator wants to verify that the integration is working and that user identity data is being received. Which FMC feature should be used to view the learned user identities and their associated IP addresses?

When you have multiple overlapping NAT rules, which rule is applied?

A security requirement mandates that QoS be applied to limit bandwidth for guest users. Where is QoS configured on an FMC-managed FTD?

Where in the FMC UI do you go to create a new Access Control Policy?

An administrator is configuring third-party SIEM integration using eStreamer on the FMC. A custom client application is written to connect to the FMC eStreamer server, but the connection is immediately reset. What is the most likely cause of this issue?

An engineer is troubleshooting a high availability failover issue in a Cisco Secure Firewall Threat Defense pair. Which THREE conditions will trigger an automatic failover event in an Active/Standby deployment? (Choose three)

An administrator is configuring a secure firewall deployment in an environment where dynamic routing via OSPF is required across multiple security zones. Which configuration requirement must be met on the Cisco Secure Firewall Threat Defense?

Which protocol does Cisco Secure Firewall Threat Defense use to exchange SGT (Security Group Tag) metadata across intermediate routers that do not support inline tagging?

When deploying an FTD in a virtual environment, what is the primary role of the 'GigabitEthernet0/0' interface by default?

What must be configured before an Access Control Rule can use a URL category?

Which component is mandatory for managing multiple FTD devices in a distributed enterprise deployment?

An administrator is configuring high availability for Cisco Secure Firewall Threat Defense using Cisco FMC. Which TWO configuration steps are required during the initial setup of an Active/Standby HA pair? (Choose two)

An administrator is configuring inline interface pairs on a Cisco Secure Firewall Threat Defense device. Which THREE characteristics apply to inline deployment mode? (Choose three)

What is the effect of changing the order of rules in an Access Control Policy?

What is the result of applying an 'IPS Policy' to an Access Control Rule?

Which TWO of the following are valid methods for deploying an FTD appliance?

An administrator configures Cisco Secure Firewall Threat Defense to send syslog messages to a remote SIEM. Which TWO features help ensure that syslog messages are transmitted securely and reliably across untrusted networks? (Choose two)

A security administrator is integrating Cisco Secure Firewall Management Center with Cisco Identity Services Engine (ISE) using pxGrid. The administrator wants to enforce identity-based policies on the Threat Defense devices. After configuring the pxGrid integration, the administrator notices that user identity information is not being populated in the FMC. The administrator verifies that the pxGrid certificate is valid and the FMC can reach ISE on port 8910. What is the most likely cause?

What must be done to apply a change made in the Access Control Policy?

An engineer is configuring a QoS policy on an FMC-managed FTD and needs to police traffic to a maximum bandwidth limit on an interface. Which shaping/policing parameter must be configured?

A security operations team deploys Cisco Secure Firewall Management Center and wants to share indicators of compromise with Cisco SecureX. The team also wants to see which internal endpoints have communicated with those indicators. Which integrated capability should be enabled to provide this context?

An administrator is troubleshooting an eStreamer connection between the FMC and a custom Python SIEM script. The connection is established, but no intrusion events appear in the SIEM. Which TWO potential reasons could explain why intrusion events are missing from the stream? (Choose two)

A network administrator is preparing to register a new Cisco Secure Firewall Threat Defense device with a Cisco Secure Firewall Management Center. The device is currently running a supported software version and has network connectivity to the management center. Which action must the administrator take on the FTD device to begin the registration process?

What is the result of using a 'Security Group' object in an Access Control rule?

In an FTD clustering deployment, how does the control plane communicate state information between the master and slave units?

What is the primary function of the 'Object Management' section in FMC?

An administrator is configuring a new FTD device in high availability (HA) mode using FMC. The administrator must ensure that the HA failover works correctly. Which two interface types must be configured to support HA operation? (Choose two.)

An administrator needs to deploy an FTD in inline mode for IPS functionality but must ensure that the traffic remains uninterrupted if the software process fails. Which feature should be enabled?

Which FTD deployment mode is best suited for an environment where the device should monitor traffic without performing any blocking or dropping actions?

An engineer deploys an Access Control Policy change from the FMC to a managed FTD device. The task hangs in the Deployment History with a status of 'Applying' for an extended period. Upon checking the FTD CLI, the engineer notices a locked deployment file or stuck process. What action should be taken to clear or restart the deployment process safely?

An administrator is configuring security zones on a Cisco Secure Firewall Threat Defense. Which TWO rules regarding security zones and interface assignments are correct? (Choose two)

An administrator needs to troubleshoot an issue where legitimate traffic is being silently dropped by the FTD device. The standard packet trace does not reveal the exact reason. Which command executed on the FTD CLI is best suited to diagnose accelerated security path (ASP) drops in real time?

When configuring the integration between Cisco Secure Firewall and Cisco ISE via pxGrid, what is the primary role of Cisco ISE in this architecture?

An engineer is deploying a Cisco Secure Firewall Threat Defense device in transparent mode between two routers. The design requires that the device forward traffic without modifying the IP headers and that it support multiple VLANs on the same physical interface. Which configuration must the engineer apply?

When configuring a QoS policy, what happens if you exceed the 'Rate Limit' set for a traffic class?

Which TWO FTD interface types are commonly used for connectivity to an ISP?

An administrator wants to configure an Access Control rule that triggers an Intrusion Policy only when specific vulnerability signatures match. Where is the Intrusion Policy assigned?

An administrator is deploying a Cisco Secure Firewall Virtual (Fv) appliance in an Amazon Web Services (AWS) environment. Which licensing model is typically supported for traffic throughput and feature activation during this cloud deployment?

When configuring Cisco Secure Firewall Threat Defense to forward syslog messages to a remote SIEM receiver, which transport layer protocols are natively supported for syslog export?

Which TWO protocols are commonly managed via Port objects in FMC?

When configuring Cisco ISE pxGrid integration within the Firepower Management Center, which TCP port must be open across the intermediate firewall for secure pxGrid communication?

An engineer needs to analyze the connection history and security events from an FTD device that occurred three weeks ago. However, when querying the FMC event viewer, the events are missing. What is the most likely cause of this behavior?

An administrator is configuring Security Intelligence on the FMC to drop traffic from known malicious IP addresses. Where in the Access Control Policy is Security Intelligence evaluated relative to standard access rules?

An administrator configures an eStreamer client script on a remote server to receive events from FMC. The script connects successfully and starts receiving events, but after a few hours, the connection drops and throws a timeout error. What is the most likely cause of this behavior?

An engineer configures Cisco Secure Firewall Threat Defense to ingest SGTs from Cisco ISE via pxGrid and wants to enforce access control based on these tags. Which TWO requirements must be met for the firewall to successfully enforce SGT-based policies? (Choose two)

What is the purpose of an 'FQDN' object in FMC?

When defining a NAT rule for an internal server, what happens if the 'DNS Rewrite' option is enabled?

In routed mode, what is the purpose of the 'Name' assigned to an interface?

An administrator is deploying static route tracking combined with IP SLA on a Cisco Secure Firewall Threat Defense device managed by Cisco FMC. Which TWO components must be configured to implement this feature successfully? (Choose two)

An engineer has deployed an active/standby High Availability pair of Cisco Secure Firewall Threat Defense devices. A failure occurs on the active unit, and a failover successfully takes place. However, upon recovery of the original active unit, it immediately resumes its role as the active unit, causing a brief secondary interruption. Which failover setting governs this behavior?

An administrator needs to monitor the real-time health and status of managed devices from the FMC dashboard. Which TWO dashboard widgets or features are available in FMC to assist with device monitoring? (Choose two)

If you need to block a specific file type (e.g., .exe) from being downloaded, which feature must you enable in the Access Control Rule?

An engineer is troubleshooting an FTD device that is not sending events to the FMC. The engineer suspects that the connection between the FTD and FMC is down. Which CLI command on the FTD should the engineer use to verify the status of the management connection to the FMC?

An engineer is configuring NGIPS inline sets on a Cisco Secure Firewall Threat Defense deployment. Which THREE configuration options or behaviors are associated with inline sets? (Choose three)

An administrator is configuring Cisco Secure Firewall Threat Defense to export syslog messages to a remote SIEM. Which TWO parameters can be customized under the FTD Platform Settings syslog configuration? (Choose two)

An administrator is troubleshooting an eStreamer integration where the client script disconnects immediately after authentication. Upon inspecting the logs, the administrator notes an SSL certificate verification error. Which TWO areas should be checked to resolve this certificate error? (Choose two)

An engineer is comparing configuration states between FMC and a managed FTD after several changes were made directly on the FTD CLI by a local technician. The engineer wants to confirm whether the device configuration currently running differs from what FMC last deployed, without pushing any new policy. Which FMC feature provides this comparison?

Which action must be taken on the FTD CLI after a manual configuration change is made, if you want to ensure the FMC does not overwrite it?

Which license state must an FTD device reach to allow the FMC to push policy configurations to it?

An administrator needs Cisco Secure Firewall Threat Defense to send connection and intrusion events to a third-party SIEM. The SIEM vendor requires that events arrive in a structured format over a reliable transport and supports only a specific event schema. Which FMC configuration should be used to meet these requirements?

An enterprise is deploying a Cisco Secure Firewall Threat Defense cluster. During the setup of the Cluster Control Link (CCL), the administrator must ensure specific networking criteria are met. What is a primary design requirement for the CCL interface?

An administrator is configuring manual NAT on an FTD device managed by FMC. Which TWO parameters must be defined when creating a manual NAT rule? (Choose two)

An administrator is integrating Cisco Secure Firewall Management Center with Cisco ISE via pxGrid. The connection fails during the certificate validation phase because the FMC rejects the ISE pxGrid certificate. Upon inspection, the FMC certificate store lacks the intermediate CA certificate of the PKI hierarchy used by ISE. How should the administrator resolve this?

You are configuring SSL decryption. To ensure that traffic to a specific financial domain is NOT decrypted due to privacy regulations, what must you configure in the SSL Decryption Policy?

An administrator needs to perform a full system backup of the FMC. Where is the most appropriate place to store this backup for long-term disaster recovery?

An enterprise environment requires streaming connection events, intrusion events, and file events from Cisco Secure Firewall Threat Defense to a third-party SIEM. Which native protocol and feature on the firewall is designed to stream these events in real time?

An administrator manages several FTD devices from a single FMC. After a policy deployment, a remote-site FTD shows 'Deployment Failed' in the FMC task list, and the administrator needs to identify which specific configuration object caused the failure without opening a TAC case. Which FMC workflow should the administrator use to review the detailed deployment failure reason for that device?

Which THREE features are critical for maintaining a stable FTD cluster?

An administrator configures an SSL Decryption Policy with a rule to 'Do Not Decrypt' financial traffic. However, the administrator also wants to ensure that the encrypted session still undergoes basic certificate validation and categorization. How does FTD handle 'Do Not Decrypt' traffic?

A network security engineer is integrating Cisco Secure Firewall Threat Defense (FTD) with Cisco Identity Services Engine (ISE) for user identity-based policies. The engineer wants to use the Cisco Platform Exchange Grid (pxGrid) to share user identity information. Which component must be configured as a pxGrid client to receive user identity data from ISE?

In an FTD cluster, which unit is responsible for assigning flow ownership to other units in the cluster?

Which command is used on the Cisco Secure Firewall Threat Defense CLI to verify that the device is successfully communicating with the Cisco Secure Firewall Management Center?

An administrator wants to check the status of all software processes running on an FMC appliance (such as the web server, database, and event handlers) to ensure everything is running smoothly. Which command should be run in the FMC CLI?

When registering a new Cisco Secure Firewall Threat Defense device to Cisco Defense Orchestrator (CDO) or Cisco FMC, what is the primary prerequisite protocol or connectivity requirement that must be established from the managed device toward the management platform?

An administrator is configuring port channels (EtherChannels) on Cisco Secure Firewall Threat Defense interfaces. Which TWO requirements or guidelines must be followed? (Choose two)

An engineer is configuring Cisco Secure Firewall Threat Defense to send syslog messages to a remote SIEM. The SIEM requires that messages be reliably delivered and that the source of the messages be authenticated. The engineer enables syslog over TCP and configures a syslog server. Which additional configuration is required to meet the SIEM's authentication requirement?

An administrator is troubleshooting an eStreamer client script failure where the connection is refused on port 8302. Which TWO potential causes should the administrator investigate? (Choose two)

An administrator wants to configure Access Control rules on Cisco Secure Firewall Threat Defense using identity context received from Cisco ISE via pxGrid. Which TWO criteria can be utilized in the Access Control policy rule configuration once pxGrid is fully integrated? (Choose two)

An administrator is analyzing a troubleshooting scenario involving Snort inspection crashes on an FTD device. Which THREE locations or tools should the administrator check to diagnose why the Snort process restarted or crashed? (Choose three)

An organization integrates Cisco Secure Firewall Threat Defense with Cisco ISE via pxGrid. The security team notices that identity rules are matching incorrect users for traffic originating from shared Citrix terminal servers or Virtual Desktop Infrastructure (VDI) multi-user hosts. What mechanism must be enabled and configured to properly handle multi-user IP identity attribution on Secure Firewall?

An administrator is troubleshooting an eStreamer client connection between a Python script and the Cisco FMC. The script fails to authenticate. Which TWO items must be verified regarding the eStreamer client credentials? (Choose two)

An administrator is planning a third-party SIEM integration with Cisco Secure Firewall Management Center. Which TWO methods or protocols are officially supported for exporting event data from the FMC to the SIEM? (Choose two)

Which THREE items are synchronized across an FTD high availability pair?

An engineer is troubleshooting a scenario where Security Group Tags (SGTs) are not being enforced by FTD access control rules despite an active pxGrid connection between ISE and FMC. Which TWO potential causes should the engineer investigate? (Choose two)

An administrator is planning the deployment of Cisco Secure Firewall Virtual in a public cloud environment (AWS or Azure). Which TWO deployment practices are recommended for ensuring high availability and performance? (Choose two)

An administrator needs to schedule automated weekly backups of the FMC configuration and store them securely on a remote SCP server. Where is remote backup storage configured in the FMC GUI?

An engineer is configuring Cisco eStreamer to stream events from FMC to a third-party SIEM. The firewall security policy blocks incoming connections on port 8302 from the SIEM server to the FMC. Which device and interface are involved in listening for the eStreamer client connection?

An administrator is designing a logging architecture where Cisco Secure Firewall Threat Defense exports connection and intrusion events to a third-party SIEM. Which TWO design principles should be followed to ensure security and scalability? (Choose two)

During a routine backup of the FMC, the administrator wants to ensure that the generated backup file contains critical historical events, configurations, and intrusion event data so that it can be fully restored to a replacement appliance if necessary. Which backup type should be selected in the FMC?

Which TWO of the following are valid high availability modes for FTD?

In which mode does the FTD firewall act as a Layer 3 hop and perform NAT?

An administrator is configuring static route tracking on a Cisco Secure Firewall Threat Defense deployment to handle link failure. If the tracked object goes down, the static route should be removed from the routing table. Where is this configuration managed when using Cisco FMC?

An administrator is preparing an upgrade plan for an FMC and its managed FTD devices. Which THREE best practices should be followed during the upgrade process to minimize downtime and avoid failure? (Choose three)

Which interface configuration mode allows the FTD to handle traffic across multiple physical links as a single logical interface?

An administrator is configuring Cisco ISE pxGrid integration with Cisco Secure Firewall Management Center. Which TWO identity sources or methods supported by ISE can provide context that is subsequently consumed by FTD via pxGrid? (Choose two)

Which object type should be used to represent a group of network subnets?

Which THREE items are required to create a port channel on an FTD device?

Which TWO of the following are valid reasons to use Transparent Mode?

When considering virtual FTD deployments, which THREE factors significantly impact the performance of the instance?

Which type of FTD interface should be configured to connect to a trunk port on a switch?

An administrator is configuring a NAT policy on FMC for an FTD device. The requirement is to translate the source IP address of internal users to a single public IP address when accessing the Internet, while preserving the source port. Which NAT type should be used?

When using clustering with FTD, what is the 'Flow Owner' in the context of traffic distribution?

An administrator wants to create a Port object group containing TCP ports 80, 443, and 8080 on the FMC. Where is this object configured?

Which THREE considerations must be addressed when deploying FTDv in a public cloud?

Which protocol is utilized by Cisco Secure Firewall Management Center and FTD devices to communicate with Cisco SecureX for cloud-delivered threat intelligence?

You are configuring static route tracking on an FTD device. What is the primary purpose of this configuration?

When deploying a Cisco Secure Firewall Threat Defense in transparent mode, how are the firewall interfaces configured to pass traffic between segments without routing?

An FTD device is deployed in routed mode with multiple security zones. An administrator needs to configure an Access Control rule that evaluates traffic flowing between two different security zones. How are security zones utilized in the rule?

Which THREE settings can be configured within a Prefilter Policy on the FMC? (Choose three)

You are troubleshooting a port channel failure on an FTD device. The port channel is 'Up/Down'. What is the most likely cause?

An enterprise security architect is designing an architecture where Cisco Secure Firewall Threat Defense integrates with a third-party SIEM. Which THREE methods or protocols are officially supported for exporting security events and logs from the FMC/Firewall to the third-party SIEM? (Choose three)

An administrator wants to export a packet capture (.pcap file) taken on an FTD interface directly from the FMC GUI for offline analysis in Wireshark. Where should the administrator navigate?

An administrator is configuring Cisco Secure Firewall Threat Defense to send syslogs to a third-party SIEM. To ensure confidentiality of sensitive log data traversing untrusted network segments, how should the syslog export be configured?

An FTD device is dropping packets unexpectedly. An engineer runs a packet tracer via the FTD diagnostic CLI using 'system support diagnostic-cli' and enters the command: 'packet-tracer input inside tcp 192.168.1.50 12345 10.0.0.5 80'. The output shows a drop at the 'Access-Rule' phase with the action 'DROP'. What does this indicate?

An administrator is configuring Cisco Secure Firewall Threat Defense to send connection and intrusion events to a third-party SIEM. Which protocol and port are natively supported by the eStreamer client integration for streaming events from the firewall?

Which THREE configuration settings must be verified on the FMC when troubleshooting syslog export issues to a third-party SIEM receiver? (Choose three)

What is the purpose of 'Network Discovery' in FMC?

An FMC administrator is configuring a URL Filtering policy. They want to block URLs categorized as 'Hacking' while logging the event. Where is this configured within the Access Control Policy?

When configuring an NGIPS appliance in passive mode, how does the system handle traffic flow to ensure monitoring without impacting the production network?

An administrator wants to ensure that all security event logs from Cisco Secure Firewall Threat Defense are exported reliably and in real time to external security analytics tools. Which TWO deployment and configuration practices should be implemented? (Choose two)

An administrator is troubleshooting an eStreamer integration where custom Python client scripts fail to receive events from the FMC. The administrator verifies that network connectivity, certificates, and user permissions are correct. Upon running the client script in verbose mode, the error indicates an 'Incompatible Protocol Version' between the client SDK and the FMC. How is this resolved?

An administrator is configuring a Cisco FTD device managed by FMC to perform application control. The administrator wants to block social networking applications while allowing business applications. Which FMC configuration element should be used to identify and control these applications?

An administrator is configuring manual NAT and needs to specify an interface pair (Source Interface and Destination Interface). Why is defining interface objects important in manual NAT rules?

A security team uses Cisco Secure Firewall Management Center (FMC) to manage several Cisco Secure Firewall Threat Defense (FTD) devices. They need to integrate with Cisco Identity Services Engine (ISE) to enforce identity-based access policies. The ISE deployment uses a standalone node with pxGrid enabled. After configuring the pxGrid client on FMC, the administrator notices that user identity data is not being populated in FMC. Which action should be taken to allow FMC to receive identity information from ISE?

How do you enable 'High Availability' (HA) for an FTD pair managed by FMC?

An administrator needs to verify that a newly registered FTD device is healthy and reachable from FMC before assigning it to a high-availability pair. Which FMC indicator confirms that the FMC-to-FTD management connection and device heartbeat are functioning normally?

An engineer is troubleshooting a stateful failover issue in a Cisco Secure Firewall Threat Defense Active/Standby high availability pair. The firewall units are passing data traffic, but failover state synchronization fails. Which dedicated interface must be verified for correct physical connectivity and configuration?

An engineer is troubleshooting a Cisco Secure Firewall Threat Defense clustering deployment where configuration synchronization between the control node and a data node has failed. Which THREE diagnostic steps or log sources should the engineer check? (Choose three)

When configuring manual NAT on an FTD device, which THREE options are available for configuring the Translated Source? (Choose three)

Which THREE types of events can be streamed natively from Cisco Secure Firewall using the eStreamer API to a third-party SIEM or custom application? (Choose three)

An administrator configures pxGrid integration between Cisco ISE and Cisco Secure Firewall Threat Defense. During the certificate enrollment process, the firewall fails to trust the ISE pxGrid node. What is the most likely root cause of this failure in a standalone FMC deployment?

Which component in an FTD cluster handles the 'Health Check' process to determine if a node is still active?

An engineer is deploying Cisco Secure Firewall Threat Defense in a routed environment where the inside network uses private RFC 1918 addresses and the outside interface connects to an ISP. The requirement is that inside hosts can reach the internet, but the firewall must not translate traffic destined for an internal server farm that is also reachable through a secondary internal interface. Which configuration approach correctly meets this requirement?

A network administrator is configuring an Access Control Policy on the FMC and needs to ensure that traffic from a specific subnet is inspected by the Snort engine for intrusion prevention. The administrator wants to achieve this with minimal performance impact on other traffic. Which action should be taken?

Which of the following must be identical on both units of an FTD high availability pair to ensure successful synchronization?

Which THREE criteria can be used to match traffic in an Access Control Policy rule?

A security engineer is creating an Access Control Policy (ACP) in FMC. The policy must block all traffic matching specific URL categories while allowing standard web browsing. However, the administrator wants users to receive a warning page before continuing to pages categorized as "Potentially Damaging Content" rather than a hard block. Which action should the engineer assign to the URL category in the ACP Rules tab?

In an FTD high availability pair, what happens to the standby unit if it loses the heartbeat signal on the failover link?

An engineer needs to troubleshoot intermittent packet loss between an FTD inside interface and a destination server. The engineer runs the 'packet-tracer' command on the FTD CLI. What limitation must the engineer keep in mind regarding packet-tracer?

An administrator is troubleshooting a scenario where configuration deployment from FMC to an FTD device fails with a 'Deployment Validation Error'. Where can the administrator view the detailed validation messages and deployment task history?

An enterprise is deploying a high-availability cluster of Cisco Secure Firewall Threat Defense devices to scale performance. Which requirement must be met regarding the physical switch infrastructure connecting the cluster nodes?

An administrator configures pxGrid integration between Cisco ISE and Secure Firewall Management Center. During the pxGrid certificate generation on ISE, the administrator must export the client certificate and keystore. What format must the client keystore be in when importing it into the FMC to establish the pxGrid trust relationship?

What is the consequence of configuring an FTD interface with 'Non-Promiscuous' mode in a virtualized deployment?

Which TWO items must be defined to create a fully functional Network Object group in FMC?

An administrator needs to verify the license status and active feature subscriptions (such as URL Filtering, Malware, and IPS) on an FMC. Where should the administrator check this information in the FMC GUI?

When deploying a Cisco Secure Firewall Threat Defense device, what is the purpose of configuring Security Zones?

You are analyzing connection events and notice a block action. Which field in the connection event details best explains why the connection was dropped by the policy?

An enterprise is deploying Cisco Secure Firewall Threat Defense virtual appliances on-premises using VMware ESXi. Which THREE prerequisites or hypervisor configurations are required for proper operation? (Choose three)

An administrator is configuring Cisco Secure Firewall Threat Defense to send syslog messages to a remote SIEM. Which TWO fields or parameters can be included in the syslog output to facilitate incident investigation and event parsing by the SIEM? (Choose two)

An administrator needs to generate a troubleshooting file from an FTD device to send to Cisco TAC. The file must include detailed configuration and diagnostic information. Which FTD CLI command should the administrator use?

An administrator is setting up Cisco SecureX threat intelligence integration with Cisco Secure Firewall Management Center. The test connection fails with a 'Token Expired or Invalid' error. What is the correct procedure to re-establish trust and authentication between the FMC and SecureX?

An administrator is configuring a Network Address Translation (NAT) rule on a Cisco FMC managed Threat Defense device. The requirement is to translate the source IP address of traffic coming from the inside zone going to the outside zone, but only for a specific internal subnet. Which NAT type must the administrator select in the FMC NAT rule configuration?

An administrator is integrating Cisco Secure Firewall Management Center with a third-party SIEM using eStreamer. The administrator needs to ensure that the eStreamer client can receive events from the FMC. Which two actions are required to configure eStreamer on the FMC? (Choose two.)

An administrator needs to troubleshoot a routing issue on an FTD device managed by FMC. Where in the FMC GUI should the administrator navigate to view and modify static and dynamic routing configurations for the device?

An administrator wants to create a Prefilter policy to fast-path (bypass Snort inspection for) a trusted backup stream between two data centers. Which action type should be selected in the Prefilter rule?

An administrator integrates Cisco Secure Firewall Management Center with Cisco ISE via pxGrid. After successful registration, the administrator wants to create an Access Control policy rule that blocks traffic from users in the 'Contractors' Security Group Tag. Where in the FMC rule creation wizard should the administrator configure this condition?

You are deploying a Cisco Secure Firewall Threat Defense cluster in a data center environment. Which deployment requirement must be strictly followed regarding the control link and data interfaces?

An administrator manages several FTD devices with FMC and needs to verify that each device's health monitor is reporting correctly after a recent configuration change. The administrator wants to view the current health status of all managed devices from a single location in the FMC GUI. Which FMC feature should the administrator use?

An administrator is deploying a new Cisco FTD device in a high-availability pair managed by FMC. The security policy requires that if the primary unit fails, the secondary unit must take over immediately without dropping existing TCP sessions. Which failover configuration must the administrator verify on the FTD devices?

Which TWO benefits are gained by integrating Cisco Secure Firewall with Cisco Identity Services Engine (ISE) using TrustSec SGTs? (Choose two)

An engineer is troubleshooting a Cisco Secure Firewall Threat Defense virtual appliance deployed in Microsoft Azure. Connectivity tests show intermittent packet drops. Which THREE troubleshooting steps or configurations should be verified in Azure and FTDv? (Choose three)

When utilizing static route tracking, what value represents the frequency of the tracking probe?

Which protocol is used by the FTD to communicate with the FMC for management traffic?

A network administrator is asked to provide a real-time view of active connections passing through a managed FTD device, including source and destination IP addresses, ports, and the applied access control rule, for an ongoing incident. Which FMC analysis tool should the administrator use?

An administrator is configuring Equal-Cost Multi-Path (ECMP) routing on a Cisco Secure Firewall Threat Defense deployment to balance traffic across two upstream next-hop routers. How does the firewall select the specific path for a given TCP flow?

You are deploying a Cisco Firepower Threat Defense (FTD) device in transparent mode. Which requirement must be met to allow traffic flow through the firewall?

An administrator needs to define network objects in the FMC Object Management menu. Which THREE object types are natively supported for network definition? (Choose three)

You are deploying FTD in a cloud environment. What is the primary purpose of the 'Management Interface' when launching the virtual instance?

An administrator wants to configure automated email notifications from the FMC whenever a critical health monitor alert occurs on any managed device. Where should this be configured in the FMC GUI?

You are deploying a Cisco FTD High Availability pair. During the synchronization process, what occurs when the standby unit fails to receive three consecutive heartbeat hellos from the primary?

An administrator is configuring a Prefilter Policy in FMC to optimize performance on a Cisco Firepower Threat Defense device. The requirement is to completely bypass inspection for a trusted high-speed data backup tunnel between two datacenters using GRE encapsulation. Which prefilter rule action should be selected?

When configuring a Port Channel on an FTD, what is the primary benefit of using LACP (Link Aggregation Control Protocol)?

An administrator is troubleshooting an FTD device that is experiencing intermittent connectivity issues. The administrator suspects that the issue is related to the data plane and wants to capture packets to analyze the traffic. Which tool in FMC should be used to capture packets on the FTD data interfaces?

An administrator is troubleshooting a Site-to-Site VPN between two FTD devices managed by FMC. The VPN tunnel is up, but traffic is not passing. The administrator suspects an issue with the crypto ACL. Which configuration element should be verified on both peers to ensure the crypto ACL matches?

You need to implement static route tracking on an FTD to ensure traffic fails over to a secondary ISP. Which object is used to define the reachability check?

An administrator is configuring an Access Control Policy on FMC and wants to log all connections that match a specific rule, including the beginning and end of each connection. Which logging action should be selected for the rule?

An administrator configures an Identity Policy on the FMC to authenticate users via Active Directory using captive portal. Where is the Identity Policy applied within the Firepower configuration hierarchy?

An administrator is configuring an inline interface pair on a Cisco Secure Firewall Threat Defense device using Cisco FMC. The business requires that if the firewall experiences a power failure or kernel panic, traffic must continue to flow uninterrupted through the network segment. Which action should the administrator take?

An administrator integrates Cisco Secure Firewall with Cisco SecureX. Which TWO components or settings are required on the FMC to establish and maintain this cloud integration? (Choose two)

Which feature in FMC allows you to group multiple physical interfaces into a single logical zone for policy assignment?

An enterprise integrates Cisco Secure Firewall with Cisco SecureX. The security team wants to leverage SecureX Threat Intelligence to automatically quarantine endpoints that exhibit malicious behavior. How does the integration coordinate this mitigation action across SecureX, FMC, and ISE?

When configuring an FQDN object, which THREE options are valid for the FQDN field?

Which TWO components must be configured to manage an FTD via the FMC?

An administrator is setting up health monitoring alerts on the FMC. Which TWO notification methods can be configured when a health alert is triggered? (Choose two)

An administrator is performing a backup and restore operation on an FMC appliance. Which THREE statements are correct regarding the FMC restore process? (Choose three)

An administrator is troubleshooting a Stateful High Availability (HA) pair of Cisco Secure Firewall 4100 series devices managed by FMC. The units are failing to form an HA state, and logs indicate a state mismatch on the control link. Which underlying cause is most likely preventing the HA synchronization?

An engineer is deploying Cisco Secure Firewall Threat Defense in a complex multi-zone routed environment. Which THREE design considerations apply when implementing routed mode interfaces? (Choose three)

A network engineer needs to configure Auto NAT on a Firepower Threat Defense device managed by FMC to translate internal subnet 10.10.10.0/24 to a single public IP address 203.0.113.50. Which translation type should be selected?

An administrator is troubleshooting an issue where Snort inspection engine crashes repeatedly on an FTD device. Which THREE diagnostic artifacts or steps should the administrator collect and perform to assist Cisco TAC in resolving the core dump issue? (Choose three)

You are configuring a static route on a Cisco Secure Firewall Threat Defense using FDM. Which parameters are strictly required to create a valid IPv4 static route?

An engineer is troubleshooting a passive NGIPS deployment where the Cisco Secure Firewall is connected to a switch SPAN port. Security analysts report that certain VLAN-tagged packets are not appearing in the event logs. What is the most likely cause?

An administrator configures Cisco Secure Firewall Threat Defense to integrate with Cisco ISE via pxGrid. Which TWO operational benefits are provided by this integration for firewall policy enforcement? (Choose two)

An engineer is deploying a Cisco Secure Firewall Threat Defense Virtual (FTDv) instance in an Amazon Web Services (AWS) VPC. The deployment requires the FTDv to inspect traffic crossing between public and private subnets. Which AWS architectural construct is mandatory for routing traffic through the FTDv instance?

An administrator needs to create a variable set to define specific port or network variables used within Intrusion Rules. Where are variable sets managed in the FMC?

An enterprise requires FTD to decrypt outbound SSL/TLS traffic so internal users visiting external websites can be inspected by Snort for malware. Which policy and action combination must be configured?

In the context of FTD, what does 'FMC' stand for?

An administrator is configuring Cisco Secure Firewall Threat Defense to send syslog messages. Which TWO options can be included in the syslog message header or content to assist SIEM correlation and analysis? (Choose two)

An administrator is configuring interface-level QoS on an FTD device. Which THREE parameters or features can be configured within an FTD QoS policy? (Choose three)

An engineer is configuring static route tracking on a Cisco Secure Firewall Threat Defense to ensure high availability for outbound internet connectivity. A backup static route is configured with a higher metric. What mechanism does the firewall use to dynamically switch from the primary route to the backup route when the primary next-hop fails?

An administrator is troubleshooting high memory utilization on an FMC appliance. Which TWO actions or tools can be used to identify resource-heavy processes or clean up storage? (Choose two)

Which THREE factors affect the choice between deploying FTD in Routed vs Transparent mode?

When configuring an FTD in Transparent Mode, how is the 'Bridge Group' created?

When configuring FMC backup schedules, which TWO storage options are natively supported for the backup files?

An organization uses Cisco Secure Firewall Threat Defense and integrates with Cisco ISE for identity policies. The security team notices that identity rules are intermittently failing because the FTD cache of IP-to-user mappings is being flushed unexpectedly. Upon investigation, what condition on FTD or ISE typically causes the purging of active user identity maps?

An administrator is creating an Access Control Policy rule on the FMC. Which TWO elements are required to create a basic rule? (Choose two)

When deploying a configuration change from FMC to FTD, what is the 'Deployment' process actually doing?

You are setting up an FTD interface. What is the difference between a 'Routed' and 'Transparent' interface mode?

An administrator is configuring an Identity Policy to enforce user-based access control. Which THREE identity sources are supported by the FMC for user awareness? (Choose three)

An administrator is setting up a new Cisco Firepower Threat Defense device and needs to configure platform-level parameters using FMC Platform Settings. Which TWO features can be configured via Platform Settings? (Choose two)

Which type of object is best suited for defining a web server's public-to-private NAT mapping?

An engineer is deploying an NGIPS inline set across two physical interfaces. To prevent network disruption during maintenance, the engineer needs to ensure that if the firewall loses power or experiences a kernel panic, traffic can still traverse the physical link. Which hardware feature must the interfaces support?

Which TWO actions must be performed on Cisco ISE when setting up pxGrid integration with Cisco Secure Firewall Management Center (FMC)? (Choose two.)

An engineer is troubleshooting Cisco SecureX threat intelligence integration with Cisco Secure Firewall Management Center. The firewall is failing to receive updated indicators of compromise. Which TWO troubleshooting steps should the engineer perform? (Choose two)

An administrator is implementing an SSL Decryption Policy on a Cisco Firepower Threat Defense device managed by FMC. The policy must decrypt outbound HTTPS traffic to inspect for malware, but certain financial domains must be excluded from decryption to comply with privacy regulations. Which rule action should be configured for these specific financial domains in the SSL Decryption Policy?

An administrator is configuring an SSL Decryption Policy on the FMC. Which TWO conditions or actions can be configured within an SSL rule? (Choose two)

An Identity Policy is configured on the FMC to authenticate users connecting through the FTD. The administrator wants to use Active Directory as the identity source. Which mechanism must be configured to map user IP addresses to usernames without requiring explicit web authentication?

Which TWO of the following are required for FTD transparent mode deployment?

An engineer deploys an NGIPS in passive mode using a SPAN (Switched Port Analyzer) port on a core switch. During traffic analysis, the engineer notices that the firewall is not seeing TCP reset packets generated by internal servers. What is the primary operational limitation of deploying an NGIPS in passive mode that explains this behavior?

An organization mandates that all integration traffic between Cisco Firepower Management Center and Cisco SecureX must be inspected. Which cloud connection mechanism does FMC use to communicate with SecureX threat intelligence and telemetry?

When troubleshooting policy deployment failures, which log file on the FMC should be examined to see the specific error returned by the device during the commit process?

An administrator is troubleshooting an FTD device that is not registering with the FMC. The administrator suspects a certificate or network issue. Which FTD CLI command should be used to verify the registration status and connectivity to the FMC?

An administrator is setting up a high availability pair of Cisco Secure Firewall devices. During the HA configuration wizard in FMC, the administrator is asked to provide a registration key. What is the purpose of this key?

When troubleshooting an issue where an FTD interface is in a 'down' state, which command helps verify if there is a physical layer issue or an administrative shutdown?

An FTD device is deployed behind a service provider router that performs NAT, meaning the external IP address assigned to the FTD's outside interface changes dynamically via DHCP. How should a Manual NAT rule be configured to handle outbound traffic referencing this dynamic outside IP?

An engineer is deploying a Cisco Secure Firewall Threat Defense Virtual (FTDv) in Google Cloud Platform (GCP). The architecture requires multiple network interfaces. How does GCP map these interfaces during deployment?

An FTD high availability pair experiences a failover due to a hardware failure on the active unit. After the standby unit takes over, the administrator notices that existing TCP connections were dropped and did not state-fully fail over. What configuration setting should the administrator verify?

When configuring ECMP (Equal-Cost Multi-Path) on FTD, what happens if one of the next-hop paths fails?

An administrator integrates Cisco Secure Firewall Management Center with Cisco SecureX. Which TWO benefits and features are unlocked by this cloud integration? (Choose two)

A network security engineer is deploying a Cisco Secure Firewall Threat Defense (FTD) device in a routed mode with two interfaces: inside (10.1.1.1/24) and outside (203.0.113.2/24). The engineer wants to allow inside hosts to reach the internet while ensuring that return traffic is permitted without creating overly permissive rules. The FTD is managed by FMC. Which deployment approach should the engineer use to meet these requirements?

When deploying an FTD appliance, which interface role is used for receiving traffic from a SPAN port?

An administrator is managing high availability failover events for Cisco Secure Firewall Threat Defense devices using Cisco FMC. Which TWO actions or events will trigger a failover from the active unit to the standby unit? (Choose two)

When deploying an FTD virtual appliance in AWS, which feature allows the FTD to scale horizontally to handle varying traffic loads?

An administrator is configuring third-party SIEM integration using syslog on Cisco Secure Firewall Threat Defense. Which TWO configuration practices are recommended to ensure optimal log management and troubleshooting? (Choose two)

An administrator is configuring static route tracking on a Cisco Secure Firewall Threat Defense device managed by FMC. A tracked IP address becomes unreachable, and the primary static route is removed from the routing table. What mechanism does FTD use to verify the reachability of the tracked destination?

An administrator is troubleshooting a Prefilter Policy configured on an FMC. Which THREE actions are available when creating a rule in a Prefilter Policy? (Choose three)

An administrator is configuring a new Access Control Policy on the Firepower Management Center and needs to add a rule that blocks peer-to-peer file sharing applications regardless of port. Which rule type should the administrator select?

An engineer is deploying a Cisco Secure Firewall Threat Defense device in a high-availability pair using Active/Standby failover. The team wants to verify which configuration items must match on both units for failover to operate correctly. (Choose two.)

Which TWO settings are available when configuring the 'Logging' tab in an Access Control Rule?

A network engineer is deploying a Cisco Secure Firewall Threat Defense cluster in spanned EtherChannel mode on two Cisco Nexus switches. The engineer must ensure that the cluster control unit and data units use the correct interfaces and that the cluster operates as designed. Which statement accurately describes the interface requirements for this deployment?

Which deployment scenario represents the correct use case for deploying a Cisco Secure Firewall Threat Defense in passive NGIPS mode?

An administrator is configuring third-party SIEM integration using eStreamer. The external client application encounters a TLS handshake failure when attempting to connect to the FMC eStreamer port. What is the standard troubleshooting step to resolve certificate validation issues between an external eStreamer client and the FMC?

An administrator is configuring a Prefilter policy to handle GRE-encapsulated traffic. Which Prefilter rule option allows handling or accelerating tunneled traffic?

An FMC high availability (HA) pair has split-brain symptoms due to a management network failure. After restoring network connectivity, the standby unit remains in a 'Failed' state and does not automatically re-synchronize. What is the correct procedure to recover the HA sync?

An enterprise integrates Cisco Secure Firewall Threat Defense with Cisco ISE via pxGrid. The security team notices that user identity mapping is intermittent for wireless clients roaming across different access points. Which TWO factors should be verified to ensure robust identity continuity during wireless roaming? (Choose two)

Which FTD deployment mode must be selected to use the device as a transparent bump-in-the-wire for security inspection?

An administrator is troubleshooting asymmetric routing issues across an FTD firewall using the FMC connection events and FTD CLI. The administrator wants to disable TCP state bypass or adjust TCP normalization settings to allow non-synchronized SYN packets through for a specific application. Where are TCP normalization and stateful inspection parameters configured for FTD?

You are configuring an active/standby High Availability pair for Cisco Secure Firewall Threat Defense using FMC. You need to configure port channels for the data interfaces to increase bandwidth and redundancy. Which guideline must be followed regarding port channels in an HA deployment?

Which menu in the FMC allows you to view the list of managed FTD devices?

Which option in the Access Control Policy rule allows you to define a specific application, such as 'Facebook', to be blocked?

An administrator configures a security intelligence feed in the FMC to block known malicious IP addresses. Where are Security Intelligence feeds and lists applied in the FMC configuration?

An administrator is investigating an issue where connection events are failing to reach the FMC from a managed FTD. Which THREE daemons or logs on the FTD and FMC should be checked to troubleshoot event transport and communication issues? (Choose three)

An engineer is troubleshooting a newly deployed FTD device where syslog messages are not reaching the external syslog server. Which tool on the FTD CLI can the engineer use to verify if the syslog generation and transmission process is attempting to send packets out the management or data interface?

An administrator is troubleshooting an SSL Decryption policy where encrypted connections are failing. The FMC logs indicate that clients are rejecting the FTD's re-signed certificate because it is not trusted. What configuration step is missing?

You are deploying a Cisco Secure Firewall Threat Defense in an existing core network as an out-of-band intrusion prevention system. Which NGIPS deployment mode should you configure to ensure the firewall performs deep packet inspection and generates alerts without dropping any production traffic in the event of a device failure or high load?

In the FMC, what is the purpose of the 'Network Discovery Policy'?

Which TWO protocols or mechanisms are used to integrate Cisco Identity Services Engine (ISE) with Cisco Secure Firewall Threat Defense? (Choose two)

When integrating Cisco Secure Firewall with Cisco SecureX, which component acts as the local orchestrator and liaison that relays threat intelligence and response actions between the managed FTD devices and the SecureX cloud?

An administrator is integrating Cisco Secure Firewall Threat Defense with Cisco Identity Services Engine (ISE) using Platform Exchange Services (pxGrid). Which service must be enabled and running on the ISE nodes for pxGrid communication to succeed?

An administrator must capture and analyze traffic on a specific FTD interface to troubleshoot an intermittent connectivity problem. The administrator wants to use FMC-native capabilities rather than logging into the device CLI. Which TWO actions can the administrator perform from the FMC to capture and then inspect the traffic? (Choose two.)

Which THREE actions can be performed by an SSL Decryption Policy?

An administrator wants to generate a health report on the FMC to present hardware utilization trends over the past 30 days. Which section of the FMC GUI provides pre-built health reports and metric tracking?

An administrator is planning an upgrade of an FMC managing multiple FTD devices across various software versions. Which THREE factors must be validated according to Cisco compatibility guidelines before proceeding? (Choose three)

An administrator is configuring Cisco SecureX threat intelligence integration with Cisco Secure Firewall Threat Defense via the FMC. Which TWO actions can be performed directly through the SecureX integration? (Choose two)

Which THREE criteria can be used to match traffic within an Access Control rule on the FMC? (Choose three)

An administrator is configuring a Cisco FTD device managed by FMC in a high-availability pair. The administrator must ensure that failover occurs correctly. Which TWO interface configurations are required to support stateful failover? (Choose two.)

When analyzing performance issues, which THREE metrics should an administrator monitor in the FMC Health Monitor?

An engineer is deploying a pair of Cisco Secure Firewall Threat Defense appliances managed by a Firewall Management Center. The requirement is that the two appliances share a single management IP address and a single data IP address so that downstream routers only need one next-hop address, and failover must occur automatically when the active unit fails. Which deployment mode should the engineer configure?

An engineer needs to troubleshoot high CPU usage on an FTD device caused by Snort. Which THREE actions or features can be adjusted or implemented to mitigate Snort CPU load? (Choose three)

An engineer is troubleshooting an integration between Cisco Secure Firewall Management Center and Cisco Identity Services Engine (ISE) using pxGrid. The FMC shows the pxGrid connection as 'Connected', but user identity information is not being populated in the FMC. Which action should the engineer take first to resolve the issue?

You are troubleshooting high availability. The units are connected, but the failover link shows as 'Down'. What is the most likely cause?

An enterprise network design incorporates Equal-Cost Multi-Path (ECMP) routing across two Cisco Secure Firewall Threat Defense units functioning independently in routed mode. What is the primary benefit of enabling ECMP on the firewalls?

An administrator is troubleshooting an FTD device that is failing to register with FMC. The FTD has been configured with the correct FMC IP address, registration key, and NAT ID. Which additional setting must be verified on the FTD to allow successful registration?

Which protocol is natively used by Cisco Secure Firewall Management Center to stream connection and intrusion events to external SIEM systems in real time?

Which FTD command-line tool is primarily used to check interface status and physical link state?

You have a large number of NAT rules. How does the FTD process them?

A security team is deploying a Cisco Secure Firewall Threat Defense device in a routed mode at the perimeter. They need to ensure that the device can be managed out-of-band on a dedicated network, separate from the data traffic, and that management traffic does not traverse the data interfaces. Which deployment approach should they use?

An administrator wants to group multiple existing port objects (e.g., TCP 80, TCP 443, TCP 8080) into a single object for use in Access Control Policy rules. Which object container should be created?

Which type of events can be exported from Cisco Secure Firewall Management Center to a SIEM using the eStreamer protocol?

You are defining an Access Control Policy rule to allow traffic. If you want to log the connection at the end of the flow only if it matches the rule, which Logging setting is appropriate?

A security engineer is integrating Cisco Secure Firewall with a third-party SIEM using eStreamer. The SIEM vendor's connector documentation requires the eStreamer event types to be parsed correctly. Which file format or protocol encoding does eStreamer use to transmit event records over TCP port 8305?

How do you identify which Access Control Rule triggered a specific connection log?

You are troubleshooting a connectivity issue. The traffic is being dropped by a Prefilter rule. What is the characteristic of traffic handled by a Prefilter policy?

In an FTD cluster, what happens if the cluster control link fails?

When editing an Access Control Rule, which action allows you to drop traffic while simultaneously sending a TCP RST to the client?

When a packet capture is running on the FTD, where can you download the resulting .pcap file for analysis in Wireshark?

An engineer is troubleshooting a Cisco ISE and Secure Firewall pxGrid integration. The administrator notices that user group memberships are not populating correctly on the FTD, even though IP-to-user mappings are visible. What is the most likely reason user group information is missing?

An administrator configures a Cisco Secure Firewall Threat Defense cluster. During normal operations, a data node experiences a critical hardware failure. What happens to the active connections currently processed by that specific failed data node?

You are deploying an FTD in a cloud environment and need to ensure high availability. Which technology is typically used to manage the virtual IP failover?

What is the result of assigning a 'Trust' action to a rule in an Access Control Policy?

Which of the following is a limitation when deploying an FTD in transparent mode?

You are configuring an NGIPS mode deployment on an FTD device. You need to ensure that the FTD can drop malicious traffic in real-time. Which mode must you select?

An administrator is performing health monitoring on an FMC appliance. Which TWO health monitors are available out-of-the-box in the FMC Health Monitor dashboard to track system resource utilization? (Choose two)

An administrator needs to create a custom Application filter object in the FMC to easily select cloud storage applications in Access Control rules. Where are application filters created?

What occurs when an 'Interactive Block' action is used in an Access Control rule?

Which menu path in the Cisco Secure Firewall Management Center (FMC) is used to configure the connection to Cisco Threat Response or Cisco SecureX?

Which TWO methods can be used to gather diagnostic information for a Cisco TAC case from an FTD device?

An engineer is deploying a Cisco Secure Firewall Threat Defense device managed by a Firewall Management Center in a high-availability pair. The engineer configures the failover link and state link, verifies interface monitoring, and then applies the configuration. After applying, the standby unit shows as failed and does not synchronize. Which action should the engineer take to resolve the issue?

Which TWO of the following are benefits of using a Port Channel on an FTD?

An administrator needs to configure Quality of Service (QoS) on a Cisco Firepower Threat Defense device via FMC to limit peer-to-peer traffic bandwidth. Where must the QoS policy be applied for it to take effect on traffic traversing the firewall?

When using a Redundant Interface, what is the primary behavior during a link failure?

An administrator wants to stream security events, connection events, and intrusion events from Cisco Secure Firewall Management Center (FMC) to a third-party SIEM platform. Which built-in protocol and feature on the FMC should be configured to export these events in real-time?

An administrator is configuring SSL Decryption to inspect internal clients browsing external websites. The organization wants to ensure that traffic to financial and health-related websites is bypassed to maintain privacy and regulatory compliance. How should this be configured in the SSL Policy?

An enterprise integrates Cisco Secure Firewall Management Center with Cisco ISE using pxGrid for identity-based access control. The security team notices that user identity mapping works for domain users authenticating via 802.1X, but guest users connecting through a WebAuth portal do not have their user-to-IP mappings populated on the FTD. What is the root cause of this issue?

A security team wants Cisco Secure Firewall Threat Defense to block traffic to domains that appear on a third-party threat feed before users connect. The feed is published as a plain-text list of malicious domains over HTTPS and changes frequently. Which integration method should be used to populate a DNS Block List on the Firewall Management Center?

An administrator is configuring a static route tracking mechanism on a Cisco Secure Firewall Threat Defense device using an ICMP Echo IP SLA object. What happens to the tracked static route if the SLA probe fails to receive a response?

An administrator wants to ensure that specific internal subnets are never subjected to NAT translation when communicating with a partner VPN tunnel. Which NAT feature achieves this?

An administrator is setting up Cisco ISE pxGrid integration with Cisco Secure Firewall Management Center. Which TWO configuration steps must be performed on the Cisco ISE side to ensure successful integration? (Choose two)

Which THREE components of an Access Control rule can be used to identify traffic as 'Application' based?

An administrator is troubleshooting intermittent connectivity loss between an FTD managed device and the FMC. Which TWO methods or tools can be used to verify registration and communication status between the managed device and the FMC? (Choose two.)

A security engineer is deploying a Cisco Secure Firewall Threat Defense device in transparent mode at a data center. The device must inspect traffic between two Layer 3 subnets without changing the IP addressing scheme. The engineer configures a bridge group and assigns two interfaces to it. Which statement describes the correct behavior of the bridge group in transparent mode?

An administrator is managing Cisco Secure Firewall Threat Defense devices using Cisco Defense Orchestrator (CDO). Which TWO capabilities does CDO provide for firewall deployment and management? (Choose two)

An administrator is configuring a new Cisco Secure Firewall Threat Defense in routed mode on Firepower Device Manager (FDM). During the initial setup, the administrator needs to define the routing behavior for a multi-zone deployment. Which configuration step is mandatory when setting up routed mode?

You are creating a custom URL category. How do you add specific domains to this category in FMC?

An engineer wants to group several FTD interfaces into a single logical zone to simplify Access Control rule creation. Where are security zones created in the FMC?

You are configuring a NAT rule and need to hide the internal network behind a single interface IP. Which NAT translation setting is required?

What is the primary function of a 'Security Zone' in FMC?

An engineer is troubleshooting a scenario where an FTD device fails its pre-upgrade health check during an upgrade initiated from the FMC. Which THREE common pre-check failures must be resolved before proceeding? (Choose three)

A security administrator is deploying a Cisco Secure Firewall Threat Defense (FTD) device and needs to configure the management interface for initial setup. The administrator plans to use the default management IP address and then change it to a static address. Which default management IP address and subnet mask are preconfigured on a new FTD appliance?

An FTD device managed by FMC is failing to download latest Snort Rule Updates (SRUs) and GeoDB updates automatically. The FMC has internet access via an HTTPS proxy. Where must the HTTPS proxy settings be configured on the FMC so that it can successfully reach Cisco update servers?

An engineer is troubleshooting a mutual TLS connection failure between Cisco ISE pxGrid and the FMC. The openssl command on the FMC reveals a 'certificate verify failed' error. What is the underlying reason for this error?

When configuring syslog export from Cisco Secure Firewall Threat Defense using Firepower Management Center, which alert format should you choose to ensure standard SIEM ingestion parsers can easily read the event headers?

Which TWO components must be configured in FMC to enable User Identity mapping for Access Control Rules?

Which THREE steps are part of a standard FTD upgrade workflow managed via the FMC?

An FMC administrator is troubleshooting a scenario where device registration between an FTD and FMC fails immediately with a registration key mismatch error. The administrator verified the NAT ID and registration key. What underlying protocol handshake fails during this registration process, and how can it be debugged?