nerdexam
Cisco

300-710 · Question #274

A security engineer needs to configure a network discovery policy on a Cisco FMC appliance and prevent excessive network discovery events from overloading the FMC database. Which action must be…

The correct answer is D. Exclude load balancers and NAT devices in the policy. To prevent excessive network discovery events from overloading the FMC database, a security engineer should configure the network discovery policy to exclude load balancers and NAT devices.

Configuration

Question

A security engineer needs to configure a network discovery policy on a Cisco FMC appliance and prevent excessive network discovery events from overloading the FMC database. Which action must be taken to accomplish this task?

Options

  • AChange the network discovery method to TCP/SYN.
  • BConfigure NetFlow exporters for monitored networks.
  • CMonitor only the default IPv4 and IPv6 network ranges.
  • DExclude load balancers and NAT devices in the policy.

How the community answered

(59 responses)
  • A
    2% (1)
  • B
    12% (7)
  • C
    5% (3)
  • D
    81% (48)

Why each option

To prevent excessive network discovery events from overloading the FMC database, a security engineer should configure the network discovery policy to exclude load balancers and NAT devices.

AChange the network discovery method to TCP/SYN.

Changing the network discovery method to TCP/SYN might slightly alter discovery behavior but does not address the fundamental issue of high event volume generated by specific network devices like NATs.

BConfigure NetFlow exporters for monitored networks.

Configuring NetFlow exporters is for collecting flow data from network devices, which is separate from optimizing the FMC's own network discovery policy.

CMonitor only the default IPv4 and IPv6 network ranges.

Monitoring only default IPv4 and IPv6 ranges reduces the scope but does not specifically target devices that inherently generate high event volumes, which are the primary cause of database overload in this scenario.

DExclude load balancers and NAT devices in the policy.Correct

Load balancers and NAT devices generate a high volume of connection events and often appear as multiple different hosts, leading to a large amount of redundant or misleading data. Excluding these devices from network discovery significantly reduces the number of events sent to the FMC database, preventing overload.

Concept tested: Cisco FMC network discovery policy optimization

Source: https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-70/network_discovery.html

Topics

#FMC Network Discovery#Policy Configuration#Database Performance#NAT/Load Balancer Exclusion

Community Discussion

No community discussion yet for this question.

Full 300-710 Practice