300-710 · Question #219
A security engineer must configure a Cisco FTD appliance to inspect traffic coming from the internet. The Internet traffic will be mirrored from the Cisco Catalyst 9300 Switch. Which configuration…
The correct answer is D. Set interface configuration mode to passive. To inspect mirrored internet traffic on a Cisco FTD appliance, the interface must be configured in passive mode, allowing for out-of-band monitoring without actively forwarding or blocking traffic.
Question
A security engineer must configure a Cisco FTD appliance to inspect traffic coming from the internet. The Internet traffic will be mirrored from the Cisco Catalyst 9300 Switch. Which configuration accomplishes the task?
Options
- ASet interface configuration mode to none.
- BSet the firewall mode to transparent.
- CSet the firewall mode to routed.
- DSet interface configuration mode to passive.
How the community answered
(34 responses)- A3% (1)
- B6% (2)
- C3% (1)
- D88% (30)
Why each option
To inspect mirrored internet traffic on a Cisco FTD appliance, the interface must be configured in passive mode, allowing for out-of-band monitoring without actively forwarding or blocking traffic.
Setting interface configuration mode to 'none' is not a recognized operational mode for traffic inspection on Cisco FTD.
Transparent firewall mode places the FTD inline as a Layer 2 bridge, actively inspecting and forwarding traffic, which would disrupt flow if a failure occurs and is not for mirrored traffic.
Routed firewall mode places the FTD inline as a Layer 3 router, actively inspecting and routing traffic, which is not suitable for monitoring mirrored traffic.
Passive interface mode on a Cisco FTD appliance is specifically designed for out-of-band monitoring of mirrored network traffic, such as from a SPAN port, enabling intrusion detection and threat analysis without affecting the actual traffic flow. This configuration allows the FTD to inspect traffic for security events without being in the active data path.
Concept tested: Cisco FTD passive mode interface deployment
Source: https://www.cisco.com/c/en/us/td/docs/security/firepower/7x/configuration/guide/fpmc-config-guide-70/interface_configuration.html
Topics
Community Discussion
No community discussion yet for this question.