An organization is distributed across several sites. Each site is connected to the main HQ using site-to-site VPNs implemented using Secure Firewall Threat Defense. Which functionality must be…

Question

Options

• AMulti-instances
• BIPsec tunnels
• CPolicy-based routing
• DECMP routing

• A
  3% (1)
• B
  5% (2)
• C
  83% (33)
• D
  10% (4)

Explanation

Policy-Based Routing (PBR) is correct because it enables traffic routing decisions based on criteria beyond the standard destination-IP routing table - such as application type or source. In this scenario, PBR lets the firewall identify SaaS-bound traffic (e.g., Microsoft 365, Salesforce) and send it directly out to the internet from the branch site, bypassing the VPN tunnel to HQ. This is the standard "internet breakout" or selective split-tunneling mechanism on Cisco Secure Firewall Threat Defense.

Why the distractors are wrong:

• A. Multi-instances - This partitions a single FTD appliance into multiple independent logical firewalls; it's a virtualization/resource-isolation feature, not a traffic steering mechanism.
• B. IPsec tunnels - IPsec tunnels are already in use (stated in the question as the site-to-site VPN method); they carry encrypted traffic between sites and HQ but provide no per-application routing control.
• D. ECMP routing - Equal-Cost Multi-Path distributes traffic across multiple equal-cost paths for load balancing/redundancy, but it has no concept of routing by application type or policy criteria.

Memory tip: PBR = "Pick a different road Based on what you're carrying." Normal routing only looks at the destination address; PBR lets you route by traffic characteristics - exactly what you need to surgically redirect SaaS traffic to the internet while keeping other traffic in the VPN.

No community discussion yet for this question.