Practice Test #1

Changing the intrusion policy from Security to Balanced only alters IPS inspection behavior and signature tuning. It may reduce false positives, but it does not stop the access control policy from denying traffic, nor does it guarantee IPS will never drop a packet. The requirement is absolute, so a tuning change is insufficient. This option addresses inspection sensitivity, not exemption from enforcement.

A Trust policy is not the same as Firewall Bypass and does not provide the strongest guarantee that traffic can never be denied. Trust is used to fastpath or reduce inspection for selected traffic, but it is still not the exam-best answer when the requirement explicitly says traffic must never be denied. Cisco uses bypass for traffic that must be exempt from the firewall decision path entirely. Therefore, Trust is too weak and too ambiguous for this requirement.

A NAT policy only changes packet addressing information such as source or destination IP values. It does not create authorization to pass traffic through the firewall, and translated traffic can still be blocked by ACP, IPS, Security Intelligence, or other controls. NAT is a connectivity and translation feature, not a guarantee against denial. Therefore, it cannot satisfy the stated business requirement.

Transparent mode with access control policies can inspect traffic without acting as the primary Layer 3 hop, so it is often used when you want to insert a firewall without changing the existing IP addressing or routing design. However, for an internal perimeter firewall that must support multiple DMZs, the more typical and scalable design is to use routed mode so the firewall terminates each DMZ segment directly. The issue is not that transparent mode cannot ever carry multiple subnets, but that it is not the best fit for this stated deployment requirement.

Routed mode with NAT configured is not required by the stated requirement. NAT is used for overlapping address spaces, hiding addresses, or publishing/egress scenarios, but multiple DMZs with unique private subnets can be routed and filtered without translation. Adding NAT could complicate troubleshooting and policy design and is only justified if the question explicitly calls for translation.

Transparent mode with NAT configured is not the best answer because NAT is not required by the scenario, and transparent mode is generally chosen to avoid making the firewall the routed boundary. While some Cisco platforms support NAT in transparent mode, that does not make it the preferred design for multiple DMZ segments with unique private subnets. The cleaner and more standard approach is routed mode with policy enforcement, adding NAT only if a separate translation requirement exists.

Inline tap monitor-only mode is not the best answer because it still relies on an inline set rather than a purely out-of-band monitoring design. Although inline tap is less disruptive than full inline enforcement and is often used to observe traffic without dropping it, it remains an inline deployment model conceptually tied to the traffic path. The question emphasizes evaluating traffic without affecting the network, which is more precisely satisfied by passive monitor-only mode. On exams, passive monitor-only is the cleaner answer whenever the requirement is zero forwarding impact.

Passive tap monitor-only mode is not standard Cisco ASA Firepower deployment terminology. Cisco commonly distinguishes between passive deployments and inline or inline tap deployments, but this option combines terms in a way that does not represent the recognized mode name. Because the exam expects official deployment mode terminology, this option should be eliminated. Even though it sounds non-intrusive, the wording itself is a clue that it is not the correct Cisco-defined answer.

Inline mode is used when the Firepower module is intended to enforce policy on live traffic. In this mode, packets are subject to inspection decisions that can permit, block, or otherwise affect forwarding, which introduces the possibility of latency, drops, or operational impact. That directly conflicts with the requirement to evaluate traffic contents without affecting the network. Therefore, inline mode is not appropriate for a non-disruptive assessment deployment.

Incorrect. Allowing CDP with a firewall rule addresses only one specific protocol and does not resolve the underlying design issue if the firewall is not operating in transparent mode. The question also mentions multicast generally, which points to a broader Layer 2 forwarding requirement rather than a single ACP exception. In Cisco FTD, proper bridge-group behavior is tied to transparent mode. A rule alone is not the primary fix for this scenario.

Incorrect. The question already states that the Cisco FTD uses bridge groups to pass traffic between inside and outside interfaces, so bridge groups are already present. Creating a bridge group again does not address the inability to use neighbor discovery or multicast. The problem is not the absence of a bridge group but the need for the correct firewall operating mode. This option repeats part of the existing configuration rather than fixing the issue.

Incorrect. Routed mode operates at Layer 3 and does not forward Layer 2 discovery protocols such as CDP between interfaces. It is the opposite of what is needed when the requirement is to preserve Layer 2 adjacency and multicast behavior across firewall interfaces. Moving to routed mode would further separate the segments and prevent non-routable protocols from traversing. Therefore, routed mode would not solve the problem.

Same flash memory size is not a prerequisite for Cisco FTD HA. The devices need to be supported for HA and run compatible software, but identical storage capacity is not what determines whether failover can be configured. Flash size may matter for image storage or local logging capacity, yet it does not affect HA pairing requirements directly. Therefore this option describes a hardware similarity that is not mandated by the HA feature.

Same NTP configuration is a best practice, not a mandatory condition to enable HA between two Cisco FTD devices. Time synchronization helps with event correlation, certificate validation, and troubleshooting, but HA formation itself does not depend on identical NTP settings. Cisco exams often distinguish between recommended operational settings and actual prerequisites. Because the question asks what must be met, NTP should not be selected.

Same host name is not required for FTD HA. In fact, unique hostnames are commonly used so administrators can distinguish the two appliances in management tools, logs, and troubleshooting output. HA uses failover roles, interface mapping, and replicated configuration rather than hostname matching. As a result, hostname equality is not a condition for enabling HA.

Security Over Connectivity prioritizes blocking and stricter enforcement, which can be appropriate for high-risk environments but is more likely to impact legitimate traffic during an initial rollout. It may enable more aggressive rule actions or broader coverage that increases false positives. This conflicts with the requirement to allow the majority of network traffic to pass during a trial.

Maximum Detection is geared toward the highest possible detection coverage and visibility, often resulting in a large volume of events and increased noise. While it can be useful for threat hunting or lab evaluation, it commonly requires significant tuning to avoid false positives and operational disruption. It is not the best choice when the goal is to test common rules but keep traffic impact low.

Connectivity Over Security is optimized to minimize traffic disruption, but it typically does so by enabling fewer intrusion rules or using less aggressive coverage. That means it may not provide enough “common Snort rule” testing value for an evaluation phase. It’s better suited when uptime and avoiding false positives are the primary goals, not when you want meaningful IPS validation.

Intrusion and file events are FMC monitoring views used to review what the system has detected (intrusion alerts, file downloads, malware dispositions, etc.). They help with analysis and troubleshooting, but they are not the feature that performs malware detection/blocking. The underlying enforcement comes from policies (ACP/file policy) and AMP capabilities, not from the event viewer itself.

File policies are configuration objects that define which file types to inspect and what actions to take (block, allow, detect) and whether to perform malware lookup. They are essential to enable file inspection, but by themselves they are not the malware analysis feature. They rely on AMP for Networks to provide file disposition and malware intelligence.

Cisco AMP for Endpoints (now Cisco Secure Endpoint) is endpoint/host-based protection installed on servers and workstations. It provides local detection, EDR-style telemetry, and response on the endpoint, not inline inspection of network traffic through the firewall. While FMC can integrate with endpoint products, this option does not describe the FMC feature for blocking malware in transit.

IPS inline link state propagation propagates physical/link status changes (for example, bringing an interface down) to help upstream devices detect failure and reroute. It is useful for certain failure scenarios, but it does not alleviate SNORT CPU/inspection overload. In fact, triggering link changes can cause convergence events and interruption, which conflicts with the goal of minimizing disruption during peak traffic.

Prefilter policies can reduce the amount of traffic sent to SNORT by fast-pathing certain flows (for example, trusted tunnels or traffic you choose not to deeply inspect). This can improve performance, but it is not the primary feature intended to keep traffic flowing when SNORT is already overwhelmed. The question asks what must be configured for overload continuity, which is better matched by Automatic Application Bypass.

A Trust ALL access control policy effectively permits traffic broadly and may reduce some inspection decisions, but it is not a proper mechanism for handling SNORT overload and is not a best-practice approach. It can severely weaken security posture and still may not prevent SNORT-related bottlenecks if intrusion/file/malware inspection remains enabled. It’s an unsafe and imprecise answer for the stated requirement.

“Unknown” means the cloud was reached and queried successfully, but the cloud does not have a definitive disposition for the file at that time. It is a verdict state about lack of intelligence, not a connectivity failure. Therefore it does not match the condition “cloud cannot be reached.”

“Clean” is a definitive benign verdict returned when the cloud (or local intelligence) determines the file is not malicious. It requires a successful evaluation/lookup and is not used as a fallback when the cloud is unreachable. Choosing “clean” would incorrectly imply the file is safe.

“Disconnected” is not the standard AMP for Networks disposition used to represent an unreachable cloud verdict lookup. While the word suggests connectivity problems, the disposition used for failed cloud reachability is “unavailable.” “Disconnected” may appear in other product status contexts, which can mislead test-takers.