Hard Difficulty Questions

The HA2 link is down or misconfigured

Why wrong: HA2 link failure would prevent sync, but version mismatch is more likely.

The HA keepalive timer is misconfigured

Why wrong: Keepalive failure leads to split-brain, not sync failure.

The passive firewall has preemption enabled

Why wrong: Preemption affects failback, not synchronization.

Configure HA1 and HA2 interfaces with appropriate IPs

Why wrong: Interfaces are required for HA communication, but they don't enable session sync.

Enable Config Sync on the HA General tab

Why wrong: Config Sync synchronizes configuration, not active session states.

Configure Path Monitoring to detect link failures

Why wrong: Path monitoring triggers failover but does not synchronize sessions.

A zone protection profile is blocking ICMP packets.

Why wrong: Zone protection would block based on flood protection, not routing.

The decryption policy is blocking the traffic because it is not decrypted.

Why wrong: Decryption applies to SSL/TLS, not ICMP.

The NAT policy is missing for the outbound traffic.

Why wrong: NAT is often needed but routing is more fundamental; the question says security policy allows but doesn't mention NAT.

Configure an SSL Forward Proxy decryption policy to decrypt HTTPS traffic.

Why wrong: Decryption is not required for threat inspection on standard ports; the firewall can inspect without decryption.

Create a Security policy rule that allows all traffic to the web server and relies on Application ID to filter.

Why wrong: Allowing all traffic would permit non-HTTP/HTTPS protocols.

Create a Security policy rule that blocks all traffic not matching the web-browsing and ssl applications.

Why wrong: This would block the intended traffic as well.

Use a self-signed certificate for decryption.

Why wrong: Self-signed certs cause trust issues; use CA-signed.

Decrypt all internal traffic including server-to-server.

Why wrong: Internal traffic often has performance and compatibility issues.

Decrypt all outbound traffic regardless of destination.

Why wrong: Not a best practice; selective decryption reduces overhead.

Use a hub-and-spoke VPN topology with headquarters as the hub

Why wrong: Hub-and-spoke forces all branch traffic through headquarters, which does not meet the local breakout requirement.

Use a full mesh VPN topology between all firewalls

Why wrong: Full mesh VPN adds complexity and does not inherently provide local internet breakout.

Deploy active/active HA at headquarters and use IPsec VPN tunnels to each branch

Why wrong: Active/active HA does not provide local breakout; branch traffic would still go through headquarters via VPN.

Use a region object instead

Why wrong: Regions are geographical, not suitable for FQDNs.

Create a dynamic address group with a tag-based filter

Why wrong: Dynamic groups filter based on tags, not FQDN resolution.

Manually add all possible IP addresses to an address group

Why wrong: Not scalable and misses new IPs.

Allow all TCP traffic on port 53.

Why wrong: TCP DNS can also be used for tunneling.

Enable logging on all DNS traffic for analysis.

Why wrong: Logging does not prevent tunneling.

Block all UDP traffic on port 53.

Why wrong: This would block legitimate DNS and cause outages.

Create a single rule with 'allow' action and no security profiles, and rely on the firewall's default behavior to inspect malware.

Why wrong: Without a security profile, no threat inspection occurs at all.

Create a single rule with 'allow' action and a 'threat' profile applied, and rely on the firewall's ability to skip inspection for video traffic automatically.

Why wrong: The firewall cannot automatically skip inspection for specific application types within a single rule; it would inspect all traffic matched by the rule.

Use policy-based forwarding to route video traffic to a separate interface that has no security profiles.

Why wrong: Policy-based forwarding does not bypass security profiles; profiles are applied based on security rules, not forwarding.

Whether logging is enabled on the rule.

Why wrong: Logging is for visibility, not for blocking decision.

Whether SSL decryption is enabled for the traffic.

Why wrong: Decryption is for inspection, not a direct cause of blocking.

Reboot the firewall to clear the pending commit

Why wrong: Rebooting could cause configuration loss and is not recommended.

Wait for the commit to complete automatically

Why wrong: If the commit is hung, waiting may not help.

Cancel the upgrade and restart

Why wrong: The pending commit must be resolved first.

Assign an IP address to the virtual wire

Why wrong: Virtual wires are layer 2 transparent; they do not have IP addresses.

Create a security policy allowing traffic on the virtual wire

Why wrong: Security policies are applied to zones, not directly to vwires; vwire interfaces are assigned to zones where policies apply.

Install a virtual wire between the virtual routers.

Why wrong: Virtual wires are for transparent mode, not inter-VR routing.

Add static routes for the remote subnets in each virtual router.

Why wrong: Static routes enable routing but not inspection; policy is still needed.

Configure a default route in each virtual router pointing to the other.

Why wrong: Only one default route per virtual router is allowed, and this does not enable inspection.

Ensure the application uses a standard port.

Why wrong: Custom apps can use non-standard ports; App-ID can still identify them.

Ensure SSL decryption is enabled for the application.

Why wrong: Decryption is not required for App-ID.

Check if the application override is applied to the correct rule.

Why wrong: Override is already in place; other factors are more likely.

The application 'webapp' is not allowed due to an application override.

Why wrong: Override would allow it, not block.

SSL decryption is not enabled.

Why wrong: Content-ID can inspect uploads without decryption if the file is unencrypted.

App-ID is not identifying the application correctly.

Why wrong: Application is already allowed.

Packet size exceeds the maximum transmission unit.

Why wrong: Packet size is unrelated.

SSL decryption is not enabled for the custom application.

Why wrong: Decryption is not required for App-ID.

The custom application needs to be added to the 'ssl' application group.

Why wrong: Groups are not required.

The application override was not committed.

Why wrong: Assuming it was committed.

The 'web-browsing' application does not include HTTP.

Why wrong: It does.

A custom application must be created for port 8080.

Why wrong: No, web-browsing works on any port.

App-ID cannot identify HTTP over non-standard ports.

Why wrong: App-ID can identify HTTP on any port.

Configure a decryption policy rule with action 'No Decrypt' for TLS 1.0 traffic.

Why wrong: Bypasses decryption but does not report the TLS version.

Use a Security policy rule to block TLS 1.0 traffic.

Why wrong: Block is too aggressive; need alert first.

Configure a decryption policy rule with action 'Decrypt' and enable 'TLS Version Check' with action 'block'.

Why wrong: Block would prevent connections, not just report.

The firewall is rejecting many sessions due to certificate errors.

Why wrong: Only 12 errors in the last hour, not 'many'.

The decryption policy is not being hit because of low policy hits.

Why wrong: Policy hits are 1800 total, indicating active usage.

The current decryption session count is at its peak.

Why wrong: Current is 523, peak is 1024, so not at peak.