nerdexam
Cisco

300-710 · Question #88

An engineer is troubleshooting application failures through a FTD deployment. While using the FMC CLI. it has been determined that the traffic in question is not matching the desired policy. What…

The correct answer is A. Use the system support firewall-engine-debug command to determine which rules the traffic. To troubleshoot why traffic is not matching a desired policy on an FTD deployment, the system support firewall-engine-debug command on the FMC CLI should be used.

Management and Troubleshooting

Question

An engineer is troubleshooting application failures through a FTD deployment. While using the FMC CLI. it has been determined that the traffic in question is not matching the desired policy. What should be done to correct this?

Options

  • AUse the system support firewall-engine-debug command to determine which rules the traffic
  • BUse the system support application-identification-debug command to determine which rules
  • CUse the system support firewall-engine-dump-user-f density-data command to change the
  • DUse the system support network-options command to fine tune the policy.

How the community answered

(34 responses)
  • A
    76% (26)
  • B
    3% (1)
  • C
    15% (5)
  • D
    6% (2)

Why each option

To troubleshoot why traffic is not matching a desired policy on an FTD deployment, the `system support firewall-engine-debug` command on the FMC CLI should be used.

AUse the system support firewall-engine-debug command to determine which rules the trafficCorrect

The `system support firewall-engine-debug` command is used on the Firepower Threat Defense (FTD) CLI to enable debugging of the firewall engine. This allows an administrator to see how traffic is processed through the Access Control Policy rules in real-time and identify exactly which rule the traffic is matching or being dropped by.

BUse the system support application-identification-debug command to determine which rules

`system support application-identification-debug` is for troubleshooting application identification issues, not specifically for policy rule matching logic.

CUse the system support firewall-engine-dump-user-f density-data command to change the

`system support firewall-engine-dump-user-f density-data` is not a standard command for debugging policy matching and its purpose is incorrect in the context of changing density data.

DUse the system support network-options command to fine tune the policy.

`system support network-options` is for viewing or modifying network interface settings, not for debugging policy rule matching.

Concept tested: FTD CLI firewall engine debugging

Source: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/troubleshooting-the-ftd.html

Topics

#FTD Troubleshooting#Access Control Policy#CLI Debugging#Firewall Engine

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-710 Practice