An engineer is deploying a Cisco ASA Secure Firewall module. The engineer must be able to examine traffic without impacting the network, and the ASA has been deployed with a single context. Which…

Question

Options

• Arouted mode with inline tap monitor-only mode
• Btransparent mode with passive monitor-only mode
• Ctransparent mode with inline tap monitor-only mode
• Drouted mode with passive monitor-only mode

• A
  16% (9)
• B
  74% (42)
• C
  7% (4)
• D
  4% (2)

Explanation

The requirement to examine traffic without impacting the network means the module must operate out-of-band (passively) - it cannot block or alter traffic. Passive monitor-only mode accomplishes this by receiving a copy of traffic without being in the forwarding path. Transparent mode is required here because a single-context ASA cannot use routed mode for the Firewall Services Module in this deployment scenario; transparent (Layer 2) mode allows the module to sit inline as a bridge while the passive option ensures no traffic impact. Inline tap mode also copies traffic but it is still technically inline and can introduce latency or failure risk. Routed mode with passive is not valid for a single-context ASA in this context. Therefore, transparent mode with passive monitor-only is the correct combination.

No community discussion yet for this question.