Refer to the exhibit. A systems administrator conducts a connectivity test to their SCCM server from a host machine and gets no response from the server. Which action ensures that the ping packets…

Question

Exhibit

Options

• ACreate an access control policy rule that allows ICMP traffic.
• BConfigure a custom Snort signature to allow ICMP traffic after Inspection.
• CModify the Snort rules to allow ICMP traffic.
• DCreate an ICMP allow list and add the ICMP destination to remove it from the implicit deny list.

• A
  93% (25)
• B
  4% (1)
• D
  4% (1)

Explanation

Cisco FTD enforces an implicit deny-all policy by default - all traffic is blocked unless explicitly permitted by an Access Control Policy (ACP) rule. ICMP (used by ping) is not automatically allowed. To permit ping traffic through the FTD, the administrator must create an ACP rule that explicitly allows ICMP traffic from the source host to the SCCM server and back. Option B is incorrect because Snort signatures are used for intrusion detection/prevention, not for traffic permitting - traffic must first be allowed by the ACP before Snort can inspect it. Option C is similarly incorrect for the same reason. Option D is not a valid FTD feature - there is no 'ICMP allow list' that bypasses the implicit deny.

No community discussion yet for this question.