nerdexam
Cisco

300-710 · Question #257

An engineer must configure the firewall to monitor traffic within a single subnet without increasing the hop count of that traffic. How would the engineer achieve this?

The correct answer is A. Configure Cisco Firepower as a transparent firewall. To monitor traffic within a single subnet without increasing the hop count, the engineer should configure Cisco Firepower as a transparent firewall, which operates at Layer 2 and acts as a wire-speed bridge.

Configuration

Question

An engineer must configure the firewall to monitor traffic within a single subnet without increasing the hop count of that traffic. How would the engineer achieve this?

Options

  • AConfigure Cisco Firepower as a transparent firewall
  • BSet up Cisco Firepower as managed by Cisco FDM
  • CConfigure Cisco Firepower in FXOS monitor only mode.
  • DSet up Cisco Firepower in intrusion prevention mode

How the community answered

(23 responses)
  • A
    83% (19)
  • C
    13% (3)
  • D
    4% (1)

Why each option

To monitor traffic within a single subnet without increasing the hop count, the engineer should configure Cisco Firepower as a transparent firewall, which operates at Layer 2 and acts as a wire-speed bridge.

AConfigure Cisco Firepower as a transparent firewallCorrect

Configuring Cisco Firepower as a transparent firewall allows it to operate at Layer 2, acting as a bridge between two network segments on the same subnet. This deployment method means the firewall intercepts and inspects traffic without introducing a new Layer 3 hop, thus not increasing the hop count for the monitored traffic.

BSet up Cisco Firepower as managed by Cisco FDM

Setting up Cisco Firepower as managed by Cisco FDM refers to the management interface, not the operational mode of the firewall that dictates how it handles network traffic and hop counts.

CConfigure Cisco Firepower in FXOS monitor only mode.

FXOS monitor only mode is related to chassis management and monitoring, not to configuring the data plane of the Firepower Threat Defense (FTD) for network traffic monitoring.

DSet up Cisco Firepower in intrusion prevention mode

Intrusion prevention mode describes the security functionality (IPS), not the network deployment mode (routed or transparent) that determines how the device integrates into the network topology and its impact on hop count.

Concept tested: Transparent firewall deployment

Source: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/transparent_firewall_mode.html

Topics

#Transparent Mode#Firewall Deployment#Traffic Monitoring#Cisco Firepower Configuration

Community Discussion

No community discussion yet for this question.

Full 300-710 Practice