350-701 · Question #663
Which feature only implements on the Cisco ASA in the transparent mode?
The correct answer is C. inspect traffic between hosts in the same subnet. The Cisco ASA in transparent mode uniquely allows for inspecting traffic between hosts that are on the same subnet, as it acts as a Layer 2 bridge rather than a Layer 3 router.
Question
Which feature only implements on the Cisco ASA in the transparent mode?
Options
- Ainspect application layer of the traffic sent between hosts
- Bstateful inspection
- Cinspect traffic between hosts in the same subnet
- Dinspect anycast traffic
How the community answered
(31 responses)- B3% (1)
- C94% (29)
- D3% (1)
Why each option
The Cisco ASA in transparent mode uniquely allows for inspecting traffic between hosts that are on the same subnet, as it acts as a Layer 2 bridge rather than a Layer 3 router.
Inspecting the application layer of traffic is a capability of both transparent and routed mode ASAs, via inspection engines and application-specific policies.
Stateful inspection is a fundamental feature of the Cisco ASA, present in both transparent and routed firewall modes, allowing it to track the state of connections.
When a Cisco ASA operates in transparent firewall mode (also known as "bump in the wire"), it acts as a Layer 2 bridge. This means it can filter traffic between hosts that reside in the same IP subnet without requiring any changes to their IP configurations. In routed mode, the ASA operates as a Layer 3 router and cannot inspect traffic between hosts on the same subnet unless that traffic is routed through it.
Inspecting anycast traffic is a routing/network design consideration, not a feature exclusively tied to transparent mode; ASAs in either mode can inspect traffic that matches their security policies, including anycast if it traverses the firewall.
Concept tested: Cisco ASA transparent mode functionality
Source: https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/ha_contexts.html
Topics
Community Discussion
No community discussion yet for this question.