300-710 · Question #274
A security engineer needs to configure a network discovery policy on a Cisco FMC appliance and prevent excessive network discovery events from overloading the FMC database. Which action must be…
The correct answer is D. Exclude load balancers and NAT devices in the policy. To prevent excessive network discovery events from overloading the FMC database, a security engineer should configure the network discovery policy to exclude load balancers and NAT devices.
Question
A security engineer needs to configure a network discovery policy on a Cisco FMC appliance and prevent excessive network discovery events from overloading the FMC database. Which action must be taken to accomplish this task?
Options
- AChange the network discovery method to TCP/SYN.
- BConfigure NetFlow exporters for monitored networks.
- CMonitor only the default IPv4 and IPv6 network ranges.
- DExclude load balancers and NAT devices in the policy.
How the community answered
(59 responses)- A2% (1)
- B12% (7)
- C5% (3)
- D81% (48)
Why each option
To prevent excessive network discovery events from overloading the FMC database, a security engineer should configure the network discovery policy to exclude load balancers and NAT devices.
Changing the network discovery method to TCP/SYN might slightly alter discovery behavior but does not address the fundamental issue of high event volume generated by specific network devices like NATs.
Configuring NetFlow exporters is for collecting flow data from network devices, which is separate from optimizing the FMC's own network discovery policy.
Monitoring only default IPv4 and IPv6 ranges reduces the scope but does not specifically target devices that inherently generate high event volumes, which are the primary cause of database overload in this scenario.
Load balancers and NAT devices generate a high volume of connection events and often appear as multiple different hosts, leading to a large amount of redundant or misleading data. Excluding these devices from network discovery significantly reduces the number of events sent to the FMC database, preventing overload.
Concept tested: Cisco FMC network discovery policy optimization
Source: https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-70/network_discovery.html
Topics
Community Discussion
No community discussion yet for this question.