Free Securing Networks with Cisco Firewalls Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Securing Networks with Cisco Firewalls practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An FTD 7.4 deployment must route between two regular firewall interfaces. How should their subnets be assigned?

   1. A. Place the two routed interfaces on different subnets.
   2. B. Place the two routed interfaces on the same subnet.
   3. C. Assign a single BVI address to both routed interfaces.
   4. D. Leave both routed interfaces without Layer 3 addressing.

   Answer: A

   Explanation: Cisco states, "Each interface that you want to route between is on a different subnet." Separate subnets are required for these regular routed interfaces; a shared BVI applies to a bridge group.

   Reference: Cisco Secure Firewall Management Center Device Configuration Guide, 7.4 — Transparent or Routed Firewall Mode — Routed firewall mode

2. 2An administrator restricts the FMC 7.4 management access list while connected over HTTPS. What must remain allowed to preserve that session after saving?

   1. A. SSH access from an unrelated management workstation.
   2. B. HTTPS access from the administrator's current source IP.
   3. C. SNMP access from the administrator's current source IP.
   4. D. HTTPS access only from the managed FTD's source IP.

   Answer: B

   Explanation: Cisco warns, "you will lose your connection when you save the configuration." This warning applies when the current source loses permission and no any/443 rule remains. Preserve HTTPS access for that source before removing broad access.

   Reference: Cisco Secure Firewall Management Center Administration Guide, 7.4 — System Configuration — Configure an access list — connection-loss warning

3. 3An FTD Virtual 7.4 device fails to register with FMC. From the device CLI, which command tests reachability to FMC through the system management network?

   1. A. show managers
   2. B. show access-list
   3. C. show conn
   4. D. ping system <FMC-IP>

   Answer: D

   Explanation: The registration troubleshooting procedure specifies "ping system" followed by the FMC IP address. This tests management-network reachability; manager registration, access-list, and connection displays do not send that probe.

   Reference: Cisco Secure Firewall Threat Defense Virtual Getting Started Guide, 7.4 — Managing with Secure Firewall Management Center — Register the Device with the Secure Firewall Management Center — registration failure checks, Ping

4. 4An FMC 7.4 access control policy permits unmatched traffic with its default action. The administrator wants file-policy inspection for that traffic. What configuration is needed?

   1. A. Attach the file policy directly to the default Allow action.
   2. B. Set the default action to Trust and attach the file policy there.
   3. C. Attach the file policy only to the network discovery policy.
   4. D. Create an explicit Allow rule and associate the file policy with it.

   Answer: D

   Explanation: Cisco states, "you cannot associate a file policy with the default action." File inspection must be associated with an explicit suitable access rule, rather than relying on the default Allow action or Trust.

   Reference: Cisco Secure Firewall Management Center Device Configuration Guide, 7.4 — File Policies for Network Malware Protection — File policies — File policy traffic flow

5. 5In routed firewall mode, an FTD 7.4 bridge group must exchange routed traffic with a regular routed interface. What must be done to its BVI?

   1. A. Remove the BVI address before enabling routing.
   2. B. Assign a name to the BVI to enable routing.
   3. C. Name only the member interfaces to enable routing.
   4. D. Move the BVI into transparent mode independently.

   Answer: B

   Explanation: The guide specifies, "To route between bridge groups/routed interfaces, you must name the BVI." Naming only the members does not enable the BVI to participate in routing, and firewall mode is not selected independently for a BVI.

   Reference: Cisco Secure Firewall Management Center Device Configuration Guide, 7.4 — Transparent or Routed Firewall Mode — Bridge virtual interfaces — BVI functionality by mode

6. 6FMC 7.4 has SNMP disabled and no SNMP access-list rules. Which setup sequence follows Cisco's prerequisite for allowing an approved SNMP polling host?

   1. A. Add the SNMP access rule, then enable SNMP polling.
   2. B. Add the SNMP access rule, leaving SNMP polling disabled.
   3. C. Enable SNMP polling, then add the SNMP access rule.
   4. D. Enable SNMP polling, leaving the access list unchanged.

   Answer: C

   Explanation: Cisco states, "To add SNMP rules to the access list, you must first enable SNMP." An access rule permits an existing service; database access, email, and FTD intrusion policy do not enable the FMC SNMP service.

   Reference: Cisco Secure Firewall Management Center Administration Guide, 7.4 — System Configuration — Configure an access list — Before you begin

7. 7A management-network ping from FTD Virtual 7.4 to FMC fails. Which CLI command does the registration troubleshooting procedure specify for checking the device's network settings?

   1. A. show network
   2. B. show managers
   3. C. show conn
   4. D. show access-list

   Answer: A

   Explanation: Cisco instructs administrators to "check your network settings using the show network command." The other displays concern managers, traffic connections, or ACLs rather than the management addressing settings needed for this check.

   Reference: Cisco Secure Firewall Threat Defense Virtual Getting Started Guide, 7.4 — Managing with Secure Firewall Management Center — Register the Device with the Secure Firewall Management Center — registration failure checks, Ping

8. 8In an inline FMC 7.4 deployment with the necessary licenses, which file-rule action checks file disposition and blocks files identified as threats rather than merely logging the disposition?

   1. A. Detect Files.
   2. B. Malware Cloud Lookup.
   3. C. Block Malware.
   4. D. Block Files.

   Answer: C

   Explanation: Cisco states that Block Malware rules "query the AMP cloud to determine if files traversing your network contain malware, then block files that represent threats." Malware Cloud Lookup allows transmission while logging the disposition, and Block Files does not condition blocking on malware disposition.

   Reference: Cisco Secure Firewall Management Center Device Configuration Guide, 7.4 — File Policies for Network Malware Protection — File rule actions — Block Malware

9. 9Two bridge groups on an FTD 7.4 device in transparent mode need to communicate across their separate networks. Where must routing between them occur?

   1. A. On either bridge group's BVI within the FTD.
   2. B. On a named member interface within the FTD.
   3. C. On a router outside the transparent-mode FTD.
   4. D. On the FTD after both groups share a policy.

   Answer: C

   Explanation: Cisco explains that "traffic must exit the Firewall Threat Defense device before it is routed by an external router back to another bridge group". Transparent bridge groups remain isolated inside the FTD; naming interfaces or sharing policy does not supply intergroup routing.

   Reference: Cisco Secure Firewall Management Center Device Configuration Guide, 7.4 — Transparent or Routed Firewall Mode — Bridge groups in transparent firewall mode

10. 10An FMC 7.4 user wants event timestamps displayed in local time while keeping the appliance in a supported time configuration. What should the user change?

    1. A. The operating system time zone from UTC to local time.
    2. B. The NTP server clock to match the user's wall clock.
    3. C. The device event timestamps by a fixed manual offset.
    4. D. The time zone setting in the user's preferences.

    Answer: D

    Explanation: Cisco instructs, "Set your preferred time zone in User Preferences to display local time accurately." System time remains UTC; changing the appliance system time zone is unsupported.

    Reference: Cisco Secure Firewall Management Center Administration Guide, 7.4 — System Configuration — Configure time settings