Scenario practice questions

In an FTD cluster, what happens if the cluster control link fails?

Trap 1: The FMC takes over the cluster.

FMC cannot take over data plane functions.

Trap 2: The cluster continues to operate normally.

State synchronization is lost.

Trap 3: The entire cluster reboots.

The cluster attempts to maintain operation.

A
The FMC takes over the cluster.
Why wrong: FMC cannot take over data plane functions.
B
The cluster nodes may disable themselves to avoid split-brain.
This prevents inconsistent traffic handling.
C
The cluster continues to operate normally.
Why wrong: State synchronization is lost.
D
The entire cluster reboots.
Why wrong: The cluster attempts to maintain operation.

Question 2easymultiple choice

Which deployment scenario represents the correct use case for deploying a Cisco Secure Firewall Threat Defense in passive NGIPS mode?

Trap 1: Acting as the default Layer 3 gateway and DHCP server for guest…

Gateway and DHCP functions require active routed mode, not passive monitoring.

Trap 2: Terminating remote access AnyConnect VPN tunnels for mobile…

VPN termination requires active interface processing.

Trap 3: Inline inspection of all core data center traffic where blocking…

Inline mode is required when blocking traffic is mandatory.

A
Out-of-band monitoring of core switch traffic using a SPAN port to detect threats without impacting production latency.
Passive mode monitors traffic via SPAN/tap out-of-band, avoiding latency or inline points of failure.
B
Acting as the default Layer 3 gateway and DHCP server for guest Wi-Fi users.
Why wrong: Gateway and DHCP functions require active routed mode, not passive monitoring.
C
Terminating remote access AnyConnect VPN tunnels for mobile employees.
Why wrong: VPN termination requires active interface processing.
D
Inline inspection of all core data center traffic where blocking malicious packets is mandatory.
Why wrong: Inline mode is required when blocking traffic is mandatory.

Question 3hardmulti select

An engineer is troubleshooting a scenario where Security Group Tags (SGTs) are not being enforced by FTD access control rules despite an active pxGrid connection between ISE and FMC. Which TWO potential causes should the engineer investigate? (Choose two)

Trap 1: The FTD management interface IP address is not registered in Active…

Management IPs do not need AD domain joins for SGT enforcement.

Trap 2: The FMC eStreamer service is disabled, blocking SGT updates.

eStreamer is for SIEM logging, not SGT propagation.

Trap 3: Syslog facility local0 is not configured on the switch.

Syslog facility settings do not impact data plane SGT enforcement.

A
The FTD management interface IP address is not registered in Active Directory.
Why wrong: Management IPs do not need AD domain joins for SGT enforcement.
B
The FMC eStreamer service is disabled, blocking SGT updates.
Why wrong: eStreamer is for SIEM logging, not SGT propagation.
C
SXP peering or inline TrustSec header propagation is missing along the data path between the endpoint and the FTD interface.
Without SXP or inline TrustSec headers, the firewall data plane does not receive SGT metadata in the packets.
D
Syslog facility local0 is not configured on the switch.
Why wrong: Syslog facility settings do not impact data plane SGT enforcement.
E
The Access Control policy rules do not have the corresponding Security Group Tags selected under the Users/SGT tab.
Rules must be explicitly configured to match the SGTs to enforce policy.

Question 4hardmultiple choice

An engineer is troubleshooting a scenario where Cisco Secure Firewall is receiving SGT information from Cisco ISE via SXP, but access control rules referencing Security Group Tags are not matching traffic. What is the most effective command to run on the Threat Defense CLI to verify that the firewall has learned the IP-to-SGT mappings?

Trap 1: show pxgrid clients

pxGrid status command, not SXP IP-to-SGT bindings.

Trap 2: show trustsec sxp connections

Shows connection states of SXP peers, not the actual IP-to-SGT mapping table entries.

Trap 3: show access-list

Shows access list hit counts and definitions, not SXP bindings.

A
show sgt mapping
The command 'show sgt mapping' displays the table of IP addresses and their associated SGTs learned via SXP or local configuration.
B
show pxgrid clients
Why wrong: pxGrid status command, not SXP IP-to-SGT bindings.
C
show trustsec sxp connections
Why wrong: Shows connection states of SXP peers, not the actual IP-to-SGT mapping table entries.
D
show access-list
Why wrong: Shows access list hit counts and definitions, not SXP bindings.

Question 5hardmultiple choice

An engineer is configuring a Cisco Secure Firewall Threat Defense cluster in a data center. To ensure high availability and prevent split-brain scenarios, what is the specific function of the cluster control link (CCL)?

Trap 1: It serves as the dedicated data forwarding path for all east-west…

East-west traffic flows through data interfaces, not the CCL.

Trap 2: It offloads all Snort inspection processing from data nodes to the…

Snort inspection is distributed across data nodes, not offloaded entirely to the control node via CCL.

Trap 3: It connects the cluster directly to the Cisco FMC management cloud…

Management connectivity uses the designated management interface, not the CCL.

A
It serves as the dedicated data forwarding path for all east-west traffic between different subnets.
Why wrong: East-west traffic flows through data interfaces, not the CCL.
B
It synchronizes configuration, connection state tables, and heartbeat health checks between cluster members.
The CCL handles inter-node communication, including state synchronization, configuration sync, and health monitoring.
C
It offloads all Snort inspection processing from data nodes to the control node.
Why wrong: Snort inspection is distributed across data nodes, not offloaded entirely to the control node via CCL.
D
It connects the cluster directly to the Cisco FMC management cloud over an encrypted TLS tunnel.
Why wrong: Management connectivity uses the designated management interface, not the CCL.

Question 6hardmultiple choice

An administrator is troubleshooting a scenario where Snort inspection threads on an FTD are crashing intermittently, producing core dumps. To assist Cisco TAC in root cause analysis, what is the correct sequence of tools or CLI commands to collect the necessary diagnostic data?

Trap 1: Log into the FMC GUI, go to System > Health > Diagnostics, and…

Purging cores deletes the diagnostic evidence needed by TAC.

Trap 2: Run 'snort-engine restart --debug' in the expert mode shell and…

Snort does not use a 'snort-engine restart --debug' command, and tcpdump cannot capture internal process stderr.

Trap 3: Export the running-config via TFTP and open the core dump files…

Core dump files are binary memory images and cannot be read with a text editor.

A
Log into the FMC GUI, go to System > Health > Diagnostics, and click 'Purge Cores'.
Why wrong: Purging cores deletes the diagnostic evidence needed by TAC.
B
Access the FTD CLI and execute the 'system support tech-support' command to generate a comprehensive diagnostic tarball containing core files and system logs.
The 'system support tech-support' command collects all logs, core dump metadata, and system state required by TAC.
C
Run 'snort-engine restart --debug' in the expert mode shell and capture live stderr streams using tcpdump.
Why wrong: Snort does not use a 'snort-engine restart --debug' command, and tcpdump cannot capture internal process stderr.
D
Export the running-config via TFTP and open the core dump files using a standard text editor.
Why wrong: Core dump files are binary memory images and cannot be read with a text editor.

Read the full NAT/PAT explanation →

Question 7hardmultiple choice

An FMC administrator is troubleshooting a scenario where device registration between an FTD and FMC fails immediately with a registration key mismatch error. The administrator verified the NAT ID and registration key. What underlying protocol handshake fails during this registration process, and how can it be debugged?

Trap 1: The HTTPS REST API (TCP 443) handshake fails; debug using 'debug…

FMC-to-FTD registration does not use the REST API.

Trap 2: The SNMP trap receiver fails; debug using 'system support…

SNMP is not used for device registration.

Trap 3: The SSH tunnel (TCP 22) fails; debug using 'tail -f…

SSH is not used for the core management registration tunnel.

A
The sftunnel (TCP 8305) handshake fails; debug using 'sftunnel status' and examining /var/log/sftunnel.log.
Registration uses sftunnel over TCP 8305. Checking sftunnel logs and status on both ends reveals certificate or key mismatches.
B
The HTTPS REST API (TCP 443) handshake fails; debug using 'debug rest-api'.
Why wrong: FMC-to-FTD registration does not use the REST API.
C
The SNMP trap receiver fails; debug using 'system support snmp-debug'.
Why wrong: SNMP is not used for device registration.
D
The SSH tunnel (TCP 22) fails; debug using 'tail -f /var/log/secure'.
Why wrong: SSH is not used for the core management registration tunnel.

Question 8mediummultiple choice

An administrator is troubleshooting a scenario where configuration deployment from FMC to an FTD device fails with a 'Deployment Validation Error'. Where can the administrator view the detailed validation messages and deployment task history?

Trap 1: Objects > Object Management > History

Object management tracks changes to individual objects, not overall deployment task execution logs.

Trap 2: Analysis > Intrusions > Events

Intrusion events display security alerts, not deployment validation errors.

Trap 3: Devices > Platform Settings > Deployment Log

Platform settings do not contain a deployment log sub-tab.

A
Objects > Object Management > History
Why wrong: Object management tracks changes to individual objects, not overall deployment task execution logs.
B
System > Monitoring > Task Manager
Task Manager tracks all FMC operations, including detailed logs of configuration deployments and error causes.
C
Analysis > Intrusions > Events
Why wrong: Intrusion events display security alerts, not deployment validation errors.
D
Devices > Platform Settings > Deployment Log
Why wrong: Platform settings do not contain a deployment log sub-tab.

Question 9hardmulti select

An administrator is analyzing a troubleshooting scenario involving Snort inspection crashes on an FTD device. Which THREE locations or tools should the administrator check to diagnose why the Snort process restarted or crashed? (Choose three)

Trap 1: Check the Cisco Smart Software Manager portal for license…

License expiration does not cause Snort process crashes or core dumps.

Trap 2: Inspect the DHCP lease logs in /var/log/dhcpd.log.

DHCP logs are unrelated to Snort inspection engine crashes.

A
Check the Cisco Smart Software Manager portal for license expiration alerts.
Why wrong: License expiration does not cause Snort process crashes or core dumps.
B
Inspect the DHCP lease logs in /var/log/dhcpd.log.
Why wrong: DHCP logs are unrelated to Snort inspection engine crashes.
C
Examine /var/log/messages and system log files for Out-Of-Memory (OOM) killer events targeting Snort.
OOM killer logs in /var/log/messages indicate if the kernel terminated Snort due to high memory consumption.
D
Review Snort runtime error logs located in /var/log/snort/ or via FMC health alerts.
Snort error logs capture rule compilation failures or segmentation faults.
E
Check for core dump files generated in the crash directories using 'system support clean-core' or expert mode listing.
Core dumps are generated when Snort crashes, providing forensic data for debugging.

Question 10hardmulti select

An engineer is troubleshooting a scenario where an FTD device fails its pre-upgrade health check during an upgrade initiated from the FMC. Which THREE common pre-check failures must be resolved before proceeding? (Choose three)

Trap 1: Active SSH sessions logged into the FTD CLI.

Active SSH sessions do not block upgrades.

Trap 2: Configured static routing tables with default gateways.

Static routes are standard and do not block upgrades.

A
Active SSH sessions logged into the FTD CLI.
Why wrong: Active SSH sessions do not block upgrades.
B
Unapplied pending configuration deployments between FMC and FTD.
Devices must be fully deployed and in sync before initiating a major software upgrade.
C
Insufficient disk space on the target upgrade partition (/var or /CiscoMFT).
Lack of disk space is one of the most common pre-check failures, requiring cleanup.
D
Active critical health monitor alarms on the device.
Critical hardware or system health alarms must be cleared before upgrade.
E
Configured static routing tables with default gateways.
Why wrong: Static routes are standard and do not block upgrades.