I85PREP
⌘ K
Cisco CBRFIR (300-215) study materials
Cisco CBRFIR (300-215) study resources

Cisco CBRFIR (300-215) practice questions

One question at a time. Build your Cisco CBRFIR (300-215) understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Firewall Fundamentals and Architecture

In Cisco's firewall deployment terminology, what does the term 'transparent mode' describe?

  1. A firewall that blocks all traffic until a license is installed and activated
  2. A firewall that inspects only encrypted TLS sessions using a decryption policy
  3. A firewall that forwards traffic at Layer 2 and is not a router hop for connected hosts Correct answer.
  4. A firewall that runs only in a public cloud and cannot be deployed on premises

Explanation

Transparent (bridged) mode places the firewall inline as a Layer 2 bridge, so hosts keep their existing default gateway and the device is not a routing hop. It is used to insert inspection without readdressing the network. Licensing and cloud deployment are unrelated to the mode definition.

Question 2Firewall Fundamentals and Architecture

Which statement best characterizes the role of the data plane on a Cisco firewall?

  1. It runs routing protocol adjacencies and builds the topology table
  2. It applies access control, NAT, and inspection to packets in the forwarding path Correct answer.
  3. It schedules software upgrades across a high-availability pair
  4. It stores configuration and provides the CLI and API endpoints

Explanation

The data plane is the forwarding path where packets are matched against policy, translated by NAT, and inspected by the various engines. Control-plane and management functions are handled separately. Keeping this distinction clear matters when troubleshooting whether a packet was dropped by policy or never forwarded at all.

Question 3Firewall Fundamentals and Architecture

A security architect wants a single management console to push policy to multiple Cisco firewall units while each unit keeps its own local forwarding decisions. Which architectural model does this describe?

  1. Spanning-tree root bridge election
  2. Standalone with local management only
  3. Manager-worker (centralized management) architecture Correct answer.
  4. Out-of-band tap deployment

Explanation

A manager-worker model centralizes policy authoring and distribution on a management appliance while the managed devices continue to forward and inspect traffic locally. This is the standard way to scale consistent policy across many firewalls. Standalone management, STP, and passive taps do not provide centralized policy push.

Question 4Firewall Fundamentals and Architecture

Which Cisco firewall feature allows an administrator to define policy once and have it applied consistently to traffic regardless of whether the flow is initiated inbound or outbound?

  1. Unified or bidirectional access control policy Correct answer.
  2. Syslog severity filtering
  3. Port-channel load balancing
  4. Static route redistribution

Explanation

Modern Cisco firewall policy is written as unified rules that match traffic in either direction, removing the need to mirror rules for inbound and outbound flows. This reduces rule sprawl and misconfiguration. Routing, link aggregation, and logging options do not affect rule directionality.

Question 5Firewall Fundamentals and Architecture

What is the primary purpose of a security zone on a Cisco firewall?

  1. To assign a routing protocol process to an interface
  2. To encrypt traffic between firewall cluster members
  3. To group interfaces that share the same trust level so policy can reference the group Correct answer.
  4. To define the order in which NAT rules are evaluated

Explanation

A zone is a logical grouping of interfaces with equivalent trust, letting policy reference the zone instead of individual interfaces. This keeps rules readable and consistent as interfaces are added. Routing processes, cluster encryption, and NAT ordering are configured separately.

Question 6Firewall Fundamentals and Architecture

Which interface type on a Cisco firewall is intentionally used to receive a copy of traffic for analysis while never forwarding or blocking that traffic?

  1. Switched port in a port channel
  2. Subinterface with 802.1Q tagging
  3. Passive or monitor-only interface Correct answer.
  4. Routed interface with a static route

Explanation

A passive or monitor-only interface receives mirrored traffic for detection and logging but is not inline, so it cannot drop or forward the original flow. This is useful for visibility without changing the traffic path. Routed, switched, and subinterface types are all inline forwarding constructs.

Question 7Firewall Fundamentals and Architecture

Which statement accurately describes a routed (Layer 3) firewall interface?

  1. It has an IP address and is a next hop that hosts can use as a default gateway Correct answer.
  2. It requires a zone to be deleted before an IP address can be assigned
  3. It learns MAC addresses and forwards frames within a broadcast domain
  4. It can only receive traffic and cannot transmit

Explanation

A routed interface is addressed at Layer 3 and can serve as a gateway, so the firewall becomes a hop in the path and can apply policy between subnets. Layer 2 learning and bridging belong to transparent mode. Interfaces are also assigned to zones rather than requiring zone deletion.

Question 8Firewall Fundamentals and Architecture

Which Cisco firewall capability inspects application-layer protocols to detect and block exploits that simple port-based rules would miss?

  1. Intrusion prevention with deep packet inspection Correct answer.
  2. DHCP relay
  3. Weighted random early detection
  4. Bidirectional forwarding detection

Explanation

Intrusion prevention engines perform deep packet inspection beyond headers, matching payload signatures and protocol anomalies to block exploits. Port-based rules alone cannot distinguish benign from malicious traffic on the same port. DHCP relay, BFD, and WRED are network services unrelated to payload inspection.

Question 9Firewall Fundamentals and Architecture

An engineer needs the firewall to send a copy of selected traffic to an external analysis tool while still forwarding the original packets normally. Which feature should be configured?

  1. Switched port analyzer or traffic mirroring to a monitoring destination Correct answer.
  2. Captive portal authentication
  3. Dynamic routing with OSPF
  4. Certificate enrollment via SCEP

Explanation

Mirroring or SPAN-style copy sends duplicate frames to a monitoring destination while the original flow continues to be forwarded and inspected. It provides out-of-band visibility without altering the traffic path. Captive portal, routing, and certificate enrollment do not duplicate packets.

Question 10Firewall Fundamentals and Architecture

A firewall pair must share connection state so that an in-progress TCP session survives a failover to the standby unit. Which design element provides this?

  1. Per-flow equal-cost multipath routing
  2. Stateful high-availability with connection replication Correct answer.
  3. DNS round-robin load balancing
  4. Stateless ACLs applied identically on both units

Explanation

Stateful HA replicates the connection and translation tables so the standby can continue existing sessions after a switchover. Without state sharing, established flows would be reset and require reconnection. Routing tricks and stateless ACLs cannot preserve session state.

Question 11Firewall Fundamentals and Architecture

Which behavior distinguishes an active/standby HA pair from an active/active HA pair on Cisco firewalls?

  1. In active/standby, one unit forwards while the peer is ready to take over; in active/active, both units forward traffic Correct answer.
  2. Active/standby requires that both units run different software versions
  3. Active/active pairs cannot share a virtual IP address
  4. Only active/standby supports stateful failover

Explanation

In active/standby, one unit carries traffic and the other waits to assume the role, whereas active/active has both units forwarding simultaneously. Stateful failover can be supported in either model when configured. Virtual addresses and matched software versions are common to both.

Question 12Firewall Fundamentals and Architecture

What is the effect of assigning an interface to a security zone that no access control rule references?

  1. The zone is merged with the highest-trust zone
  2. Traffic on that interface is denied by the implicit default deny unless another rule matches Correct answer.
  3. The interface is placed into transparent mode automatically
  4. Traffic on that interface is automatically permitted

Explanation

Cisco firewall policy ends with an implicit deny, so a zone with no matching permit rule results in dropped traffic. Being in a zone does not itself grant or deny access; the rules do. Automatic mode changes or zone merging do not occur.

Question 13Firewall Fundamentals and Architecture

When a packet arrives at a firewall, which sequence best reflects how policy is typically evaluated?

  1. NAT translation, then logging, then access control rule match
  2. Access control rule match, then NAT translation, then inspection of permitted flows Correct answer.
  3. Access control rule match, then logging, then NAT translation
  4. Inspection engine, then NAT translation, then access control rule match

Explanation

Access control rules are matched first to decide whether the flow is allowed; NAT is then applied to permitted flows, and inspection engines process the traffic that survives the policy. Logging accompanies the decision rather than preceding it. Understanding this order explains why a denied flow never reaches NAT.

Question 14Firewall Fundamentals and Architecture

Which Cisco firewall feature authenticates users against an external directory so that policy can match on user identity rather than source IP alone?

  1. Identity policy with an LDAP or Active Directory realm Correct answer.
  2. Link Layer Discovery Protocol
  3. Static ARP entries
  4. BGP route reflectors

Explanation

Identity policy integrates with directory services such as LDAP or Active Directory, mapping users to identity so rules can reference user or group objects. This decouples policy from shifting IP addresses. ARP, BGP, and LLDP serve entirely different purposes.

Question 15Firewall Fundamentals and Architecture

Which statement about NAT on a Cisco firewall is accurate?

  1. NAT is applied before access control rules are evaluated
  2. NAT automatically disables intrusion inspection for translated flows
  3. NAT translates addresses or ports and can be combined with policy in a single rule Correct answer.
  4. NAT can only be configured on transparent interfaces

Explanation

NAT performs address or port translation and modern platforms allow it to be expressed alongside access policy in a unified rule. It is applied after the access decision and is supported in routed deployments. Translation does not disable inspection.

Question 16Firewall Fundamentals and Architecture

A network uses a firewall in transparent mode. What must be true of the hosts on the protected segment?

  1. They can keep their existing gateway because the firewall bridges traffic Correct answer.
  2. They must use a different VLAN than the firewall's management interface
  3. They must run a VPN client to reach the internet
  4. They must point to the firewall as their default gateway

Explanation

Because a transparent firewall bridges frames at Layer 2, hosts keep their current default gateway and require no readdressing. The firewall still inspects and can block the bridged traffic. Gateway changes and VPN clients are not required for transparent insertion.

Question 17Firewall Fundamentals and Architecture

Why would an architect choose a firewall cluster with a single virtual management IP over several independently managed appliances?

  1. It forces all traffic through a single physical link
  2. It removes the need for any access control policy
  3. It presents one configuration and failover domain, simplifying consistent policy and monitoring Correct answer.
  4. It eliminates the need for stateful failover

Explanation

A cluster presents a unified configuration and management endpoint, so policy stays consistent and monitoring is consolidated while failover is handled within the cluster. Policy is still required, and stateful failover remains a configured feature. Traffic is not forced onto one physical link.

Question 18Firewall Fundamentals and Architecture

Which statement correctly describes the relationship between virtual routers and interfaces on a Cisco firewall?

  1. Interfaces cannot be assigned to a virtual router
  2. A virtual router can only exist in transparent mode
  3. Each interface can belong to only one virtual router, and virtual routers keep separate routing tables Correct answer.
  4. Virtual routers share a single routing table across all instances

Explanation

Virtual routers provide separate routing domains, and each interface is assigned to exactly one of them so their tables remain independent. This supports overlapping address space and traffic separation. Virtual routers are not limited to transparent mode, and they do not share one table.

Question 19Firewall Fundamentals and Architecture

An administrator observes that a flow is dropped even though a permit rule exists. The rule references a zone that the ingress interface does not belong to. What is the most likely explanation?

  1. The interface was converted to a passive interface
  2. NAT translated the source into the zone
  3. The rule does not match because zone membership is evaluated as part of the match criteria Correct answer.
  4. The inspection engine disabled the zone automatically

Explanation

Access rules match on source and destination zones, so a rule referencing a zone the interface does not belong to cannot match the flow and the implicit deny applies. Zone membership is a match condition, not something inspection or NAT changes. Passive conversion would be an explicit administrative action.

Question 20Firewall Fundamentals and Architecture

Which design consideration most directly affects whether a firewall can enforce policy on traffic between two hosts in the same IP subnet?

  1. Whether the management interface is on a separate VLAN
  2. Whether the firewall uses NTP authentication
  3. Whether the firewall is inline as a Layer 3 hop or a Layer 2 bridge between those hosts Correct answer.
  4. Whether syslog is configured at severity level 7

Explanation

Intra-subnet traffic does not cross a router, so enforcement requires the firewall to sit inline as a bridge or otherwise be in the path between the hosts. Logging severity, time synchronization, and management VLAN placement do not determine whether the traffic traverses the firewall.

Question 21Firewall Fundamentals and Architecture

A firewall pair is configured for active/standby but state replication is failing. What is the most likely operational consequence during a switchover?

  1. Established sessions are reset because the standby lacks their state, requiring clients to reconnect Correct answer.
  2. New flows are denied while existing flows continue uninterrupted
  3. The standby unit automatically becomes the active unit permanently
  4. Both units begin forwarding simultaneously

Explanation

Without state replication the standby has no connection or translation entries, so established sessions cannot continue after failover and are typically reset. New flows may still be permitted by policy, but continuity is lost. Simultaneous forwarding and permanent role changes are not consequences of replication failure.

Question 22Firewall Fundamentals and Architecture

Which statement best explains why a single unified rule can replace separate inbound and outbound rules for the same application flow?

  1. Unified rules are only evaluated once at connection setup and never again
  2. Unified rules bypass inspection and therefore apply to both directions
  3. Unified rules require NAT to be disabled for the flow
  4. Unified rules match on source and destination zones and are evaluated bidirectionally for the connection Correct answer.

Explanation

A unified rule matches source and destination zones and applies to the connection as a whole, so one rule covers the flow regardless of which side initiates it. Inspection still applies, and the rule is not limited to a single direction. NAT is independent of rule directionality.

Question 23Firewall Fundamentals and Architecture

Which combination best reflects defense in depth on a Cisco firewall platform?

  1. Only port-based ACLs on the outside interface
  2. Access control, intrusion prevention, malware inspection, and URL filtering applied together Correct answer.
  3. Only syslog collection with no enforcement
  4. Only a default route pointing to the internet

Explanation

Defense in depth layers multiple enforcement technologies so a gap in one control is covered by another. Access control, intrusion prevention, malware inspection, and URL filtering each address different threats. Routing, port-only ACLs, and logging alone provide no layered enforcement.

Question 24Firewall Fundamentals and Architecture

Which Cisco firewall concept describes a logical grouping of interfaces whose traffic is inspected as one policy domain, commonly used to separate user, server, and internet segments?

  1. Security zone Correct answer.
  2. Port channel
  3. NAT pool
  4. Virtual routing table

Explanation

Security zones group interfaces of equivalent trust so policy can be written between segments such as users, servers, and the internet. Virtual routing tables separate routing domains, port channels aggregate links, and NAT pools supply translated addresses.

Question 25Firewall Fundamentals and Architecture

What is the purpose of the implicit default deny at the end of a Cisco firewall access control policy?

  1. It drops traffic that matches no explicit permit rule Correct answer.
  2. It logs traffic and then permits it
  3. It disables inspection for unmatched flows
  4. It permits traffic that matches no rule

Explanation

The implicit deny ensures that any traffic not explicitly permitted is dropped, following the principle of least privilege. Administrators must write permits for allowed flows. It does not permit, log-and-permit, or disable inspection for unmatched traffic.

Question 26Firewall Fundamentals and Architecture

On a Cisco firewall, which interface role is used to carry management traffic such as SSH and management-center registration while being kept separate from data forwarding?

  1. A management-only interface Correct answer.
  2. A routed data interface
  3. An inline passive tap interface
  4. A monitor-only interface

Explanation

A management-only interface is dedicated to administrative access and control-plane traffic such as SSH, SNMP, and registration to a management center. It does not forward transit user data, which keeps administrative reachability separate from the production forwarding path.

Question 27Firewall Fundamentals and Architecture

Which statement describes how a Cisco firewall handles traffic that matches no explicit rule in the access control policy?

  1. It is logged and forwarded to the default gateway.
  2. It is dropped by the implicit default deny at the end of the policy. Correct answer.
  3. It is permitted because inspection engines vouch for it.
  4. It is queued for administrator approval before forwarding.

Explanation

Access control policies end with an implicit deny, so any connection that matches no explicit rule is dropped. This default-deny posture means administrators must add explicit permits for desired traffic rather than blocking undesired traffic.

Question 28Firewall Fundamentals and Architecture

Which Cisco firewall deployment mode forwards traffic at Layer 2 and therefore requires the protected hosts to remain in the same subnet as the adjacent router interface?

  1. Transparent mode Correct answer.
  2. Routed mode
  3. Inline tap mode
  4. Management-only mode

Explanation

In transparent mode the firewall acts as a Layer 2 bridge, so it does not perform routing between subnets. Hosts on the protected segment must therefore stay in the same subnet as the upstream router interface.

Question 29Firewall Fundamentals and Architecture

An engineer assigns an interface to a zone, but that zone is not referenced by any access control rule. What is the practical consequence for traffic entering on that interface?

  1. The traffic bypasses inspection but is still routed normally.
  2. The traffic is permitted because the zone has no restrictions.
  3. The traffic matches no permit rule and is dropped by the default deny. Correct answer.
  4. The traffic is automatically redirected to the management interface.

Explanation

Policy is expressed as rules that reference zones, so a zone absent from every rule cannot match a permit. Traffic from that interface therefore falls to the implicit deny and is dropped.

Question 30Firewall Fundamentals and Architecture

A firewall pair must share connection state so an established TCP session continues after a failover. Which mechanism accomplishes this on Cisco firewalls?

  1. Zone-to-zone inspection on the standby unit only
  2. NAT translation pooling shared between peers
  3. Dynamic routing convergence between the peers
  4. Stateful failover replication over the high-availability link Correct answer.

Explanation

Stateful failover replicates connection and translation state from the active unit to the standby over the high-availability link. When a switchover occurs, the standby already holds the session table and can continue existing flows without re-establishing them.

Question 31Firewall Fundamentals and Architecture

Which statement best describes the difference between active/standby and active/active high availability on Cisco firewalls?

  1. Active/standby replicates state, while active/active does not replicate state at all.
  2. Active/standby requires transparent mode, while active/active requires routed mode.
  3. In active/standby both units forward; in active/active only one unit forwards at a time.
  4. In active/standby one unit forwards while the peer waits; in active/active both units forward traffic. Correct answer.

Explanation

In active/standby, one unit carries traffic and the other remains ready to take over, whereas active/active has both units forwarding simultaneously. Both models replicate state so that sessions survive a failure.

Question 32Firewall Fundamentals and Architecture

A packet arrives at a Cisco firewall. Which sequence best reflects how policy is typically evaluated for a new connection?

  1. Match zone-to-zone access rule, apply NAT, then pass to the inspection engine Correct answer.
  2. Evaluate NAT, apply inspection, then match access rules
  3. Apply inspection engine, match NAT, then evaluate access rules
  4. Match access rules, apply inspection, then evaluate NAT

Explanation

For a new connection the firewall matches the access control rule for the source and destination zones, applies any matching translation, and then hands the flow to the relevant inspection engine. Established flows are then matched against the session table rather than re-evaluated from scratch.

Question 33Firewall Fundamentals and Architecture

Which Cisco firewall feature authenticates users against an external directory so that policy can match on user identity rather than only on IP address?

  1. Static NAT with port address translation
  2. Identity-based access control using an external identity source Correct answer.
  3. Link aggregation across cluster members
  4. Spanning Tree Protocol root guard

Explanation

Identity-based policy binds a user to an IP address after authenticating against an external directory or identity service. Rules can then match on user or group identity, which is more stable than matching on dynamic host addresses.

Question 34Firewall Fundamentals and Architecture

Why would an architect choose a firewall cluster with a single virtual management IP over several independently managed units?

  1. It eliminates the need for access control rules entirely.
  2. It presents one policy and management point while the cluster shares traffic handling. Correct answer.
  3. It removes the need for any high-availability state replication.
  4. It forces all traffic through a single physical appliance.

Explanation

A cluster virtual management IP gives administrators one address for configuration and monitoring while the cluster distributes and protects traffic across members. This reduces configuration drift compared with managing each unit separately.

Question 35Firewall Fundamentals and Architecture

A flow is dropped even though a permit rule exists. The rule references a zone that the ingress interface does not belong to. What is the most likely cause?

  1. The inspection engine is disabled globally on the device.
  2. The NAT policy is translating the source address incorrectly.
  3. The default route is missing from the routing table.
  4. The interface's zone membership does not match the rule's source zone, so the rule never matches. Correct answer.

Explanation

Rules match on the zones of the ingress and egress interfaces, so an interface in a different zone than the rule specifies will not match that rule. The connection then falls through to the implicit deny.

Question 36Firewall Fundamentals and Architecture

Which design consideration most directly determines whether a firewall can enforce policy on traffic between two hosts in the same subnet?

  1. Whether that inter-host traffic is actually routed through the firewall rather than switched locally Correct answer.
  2. Whether the firewall has a default route toward the internet
  3. Whether the firewall uses a management-only interface for administration
  4. Whether the firewall uses a virtual router for the management network

Explanation

Traffic between hosts in the same subnet is normally switched locally and never reaches a firewall, so policy cannot apply. Enforcement requires the traffic to be routed through the firewall, for example by placing hosts in different subnets or using a Layer 2 insertion point.

Question 37Firewall Fundamentals and Architecture

On a Cisco firewall, which interface configuration is required before that interface can forward user traffic through the access control policy?

  1. The interface must be bound to an external tap port for traffic replication
  2. The interface must be configured as a diagnostic interface with a dedicated loopback address
  3. The interface must be assigned a name and a security zone, and it must be enabled Correct answer.
  4. The interface must be placed in passive monitor-only mode until a license is installed

Explanation

A data interface on a Cisco firewall only becomes usable for policy enforcement once it has a name, is mapped to a security zone, and is brought up administratively; until then it stays shutdown and passes nothing. The name and zone association are what allow access control rules written against zones to match traffic entering that interface.

Question 38Firewall Fundamentals and Architecture

A security team wants the firewall to inspect traffic between two virtual machines hosted on the same hypervisor host without sending that traffic off the physical host. Which architecture should the architect evaluate?

  1. A transparent Layer 2 deployment between the hypervisor and the physical uplink
  2. A SPAN session that copies intra-host traffic to a remote physical firewall
  3. A virtual firewall instance running inside the hypervisor, with VM traffic steered through it Correct answer.
  4. A routed deployment with each VM's gateway pointing at a physical firewall outside the host

Explanation

Traffic between VMs on the same host can stay entirely inside the virtual switch, so a physical appliance outside the host never sees it. A virtual firewall instance inside the hypervisor, with traffic redirected through it, is the architecture that keeps enforcement in the path of that east-west flow.

Question 39Firewall Fundamentals and Architecture

An engineer is comparing a firewall deployed in routed mode with one deployed in transparent mode. Which statement correctly captures a functional difference between the two?

  1. Transparent mode supports dynamic routing protocols, while routed mode relies only on static routes
  2. Routed mode can perform NAT and act as a Layer 3 hop, while transparent mode forwards at Layer 2 as a bump in the wire Correct answer.
  3. Transparent mode cannot enforce access control policy, while routed mode can
  4. Routed mode requires re-addressing protected hosts, while transparent mode preserves existing IP addressing

Explanation

In routed mode the firewall is a Layer 3 device with interfaces in different subnets, so it can route, perform NAT, and terminate VPNs. In transparent mode it bridges at Layer 2 and is inserted without changing the existing IP topology, which is why it is described as a bump in the wire.

Question 40Firewall Fundamentals and Architecture

A firewall cluster uses a single virtual management IP for administration. An operator asks why per-unit addresses still exist on each node. What is the accurate explanation?

  1. Per-unit addresses are needed only for licensing and can be removed after registration
  2. Per-unit addresses exist so that data traffic can be load balanced across cluster members
  3. Per-unit addresses let each node be reached individually for tasks such as state synchronization and troubleshooting, while the virtual IP provides one stable administrative target Correct answer.
  4. Per-unit addresses are legacy artifacts and have no operational function in a cluster

Explanation

The virtual management address gives administrators and management centers one consistent target that survives a failover of the cluster master role. The underlying per-unit addresses remain necessary for cluster control traffic, state replication, and reaching a specific node directly during troubleshooting.

Question 41Cisco Secure Firewall Deployment and Initial Configuration

A firewall administrator is registering a new Secure Firewall Threat Defense device with a cloud-delivered management platform. Which outbound connectivity does the device require for this onboarding?

  1. A dedicated IPsec tunnel over UDP 500 negotiated before registration
  2. An outbound HTTPS connection over TCP 443 to the cloud management service Correct answer.
  3. An inbound SSH session initiated by the cloud service over TCP 22
  4. An outbound syslog stream over UDP 514 to the cloud service

Explanation

Threat Defense devices onboarded to a cloud-delivered management platform establish an outbound HTTPS connection on TCP 443 to the cloud service; no inbound ports must be opened on the perimeter. Registration is initiated from the device toward the cloud, so the management plane never dials into the device.

Question 42Cisco Secure Firewall Deployment and Initial Configuration

During initial setup of a Secure Firewall Threat Defense device, the administrator runs the setup wizard on the console. Which parameter must be supplied so the device can reach the internet for licensing and updates?

  1. The NetFlow collector address
  2. The RADIUS shared secret
  3. The SNMP trap destination
  4. The default gateway address Correct answer.

Explanation

The initial setup prompts for management addressing that includes IP address, subnet mask, and default gateway; without a correct default gateway the device cannot route traffic off its local subnet to reach licensing and update services. NetFlow, RADIUS, and SNMP are optional integrations configured later.

Question 43Cisco Secure Firewall Deployment and Initial Configuration

An engineer is preparing a Secure Firewall Management Center virtual appliance. Which statement describes the correct deployment order for the management center and its managed devices?

  1. Register Threat Defense devices first, then deploy the management center to discover them
  2. Deploy the management center first, then register Threat Defense devices to it Correct answer.
  3. Deploy the management center only after all managed devices have valid licenses
  4. Deploy both simultaneously and let the devices auto-discover the management center

Explanation

The management center must be deployed and reachable before managed devices can register to it, because registration is a device-initiated action directed at the management center's address. The management center then holds device records, policy, and health monitoring for the registered fleet.

Question 44Cisco Secure Firewall Deployment and Initial Configuration

Which interface type on a Secure Firewall Threat Defense device is used exclusively for out-of-band management and cannot carry transit user traffic?

  1. The DMZ interface
  2. The outside interface
  3. The inside interface
  4. The management interface Correct answer.

Explanation

The dedicated management interface carries administrative access and device management traffic only; it is not part of the data forwarding path. Inside, outside, and DMZ interfaces are data interfaces that forward user traffic according to policy.

Question 45Cisco Secure Firewall Deployment and Initial Configuration

A device must be configured so that its management center connection survives a temporary internet outage. Which setting supports this requirement?

  1. Set the management center address to a link-local address
  2. Enable DHCP on the management interface
  3. Disable the management interface to force traffic through the data plane
  4. Configure a static default route and verify DNS resolution for the management center FQDN Correct answer.

Explanation

Resilient cloud or management center connectivity depends on a correct static default route and working DNS so the device can resolve and reach the management center FQDN after an outage. Removing management connectivity or relying on DHCP/link-local addressing would make recovery unreliable.

Question 46Cisco Secure Firewall Deployment and Initial Configuration

An administrator needs the Threat Defense device to obtain its license entitlement through a registration token. Which component issues and validates that token?

  1. The local RADIUS server
  2. The device's own self-signed certificate store
  3. The Smart Licensing authority reached over the internet Correct answer.
  4. The management center's internal certificate authority

Explanation

Smart Licensing uses a registration token obtained from the licensing authority, which the device presents over the internet to claim entitlements. RADIUS, internal certificate authorities, and local certificate stores do not issue or validate licensing tokens.

Question 47Cisco Secure Firewall Deployment and Initial Configuration

After registering a Threat Defense device to a management center, an engineer notices the device shows as registered but policy deployment fails. Which condition most likely explains the failure?

  1. The device has Smart Licensing enabled
  2. The device is using a static IP address on its management interface
  3. The device cannot reach the management center on the required management ports Correct answer.
  4. The device has more than one data interface configured

Explanation

Policy deployment requires a healthy management channel; if the device cannot reach the management center on the required ports, registration may appear complete while deployments fail. Multiple data interfaces, static addressing, and enabled licensing are all normal and do not by themselves block deployment.

Question 48Cisco Secure Firewall Deployment and Initial Configuration

Which CLI command on a Threat Defense device verifies that the management center connection is up and shows the management center's address?

  1. show route
  2. show interface ip brief
  3. show managers Correct answer.
  4. show version

Explanation

The show managers command reports the configured manager type and address and indicates whether the management connection is currently established. Interface, routing, and version commands provide unrelated details and do not confirm manager connectivity.

Question 49Cisco Secure Firewall Deployment and Initial Configuration

An engineer is planning a high-availability pair during initial deployment. Which requirement must be satisfied before forming the pair?

  1. Both units must use different management IP addresses on the same subnet
  2. Each unit must use a different registration token
  3. Both units must run the same software version and have matching interface configurations Correct answer.
  4. Each unit must have a unique management center registered to it

Explanation

High-availability pairs require identical software versions and symmetric interface configuration so state and traffic can be synchronized reliably. The units share a management center, and their management addresses must be unique but on the same network, so mismatched software is the blocking issue.

Question 50Cisco Secure Firewall Deployment and Initial Configuration

Which interface mode on a Threat Defense device allows multiple VLAN-tagged subinterfaces to share a single physical interface?

  1. Switched ports in access mode
  2. Routed subinterfaces on a physical interface Correct answer.
  3. Passive interfaces
  4. Inline tap interfaces

Explanation

Routed subinterfaces let a single physical interface carry multiple VLAN-tagged logical interfaces, each with its own addressing and policy. Passive and tap modes are monitoring constructs, and access-mode switch ports do not provide routed subinterface addressing.