300-710 · Question #169
An engineer is troubleshooting connectivity to the DNS servers from hosts behind a new Cisco FTD device. The hosts cannot send DNS queries to servers in the DMZ. Which action should the engineer…
The correct answer is A. Use the packet capture tool to check where the traffic is being blocked and adjust the access. Packet capture on the FTD allows the engineer to observe the actual DNS query packets flowing through the device, identifying if and where the traffic is dropped or blocked. This helps determine whether access control policies or intrusion policies are preventing DNS queries…
Question
An engineer is troubleshooting connectivity to the DNS servers from hosts behind a new Cisco FTD device. The hosts cannot send DNS queries to servers in the DMZ. Which action should the engineer take to troubleshoot this issue using the real DNS packets?
Options
- AUse the packet capture tool to check where the traffic is being blocked and adjust the access
- BUse the Connection Events dashboard to check the block reason and adjust the inspection policy
- CUse the packet tracer tool to determine at which hop the packet is being dropped
- DUse the show blocks command in the Threat Defense CLI tool and create a policy to allow the
How the community answered
(66 responses)- A76% (50)
- B14% (9)
- C8% (5)
- D3% (2)
Explanation
Packet capture on the FTD allows the engineer to observe the actual DNS query packets flowing through the device, identifying if and where the traffic is dropped or blocked. This helps determine whether access control policies or intrusion policies are preventing DNS queries from reaching the servers in the DMZ. firepower-threat-defense-f.html#anc34
Topics
Community Discussion
No community discussion yet for this question.