Firewalls & NGFW Practice Questions

Answers and explanations appear when you work through the set above.

1. At which network layer does Cisco Umbrella block security threats (such as malware, phishing, and command-and-control callbacks) before a TCP/IP connection is established?

   • Application Layer HTTP/HTTPS Proxy only
   • Domain Name System (DNS) Resolution Layer
   • Layer 2 Ethernet frame (MAC address) layer
   • Layer 3 IP Routing Table Layer

2. What capabilities differentiate Application Visibility and Control (AVC) on a Next-Generation Firewall (NGFW) from standard Layer 4 port filtering?

   • AVC matches Layer 7 application signatures, whatever port the traffic uses.
   • AVC classifies only ICMP and other control traffic, leaving TCP and UDP to the ACLs.
   • AVC replaces the routing table, forwarding each flow by its application name.
   • AVC needs a static mapping of each application to its public destination IP addresses.

3. In a Cisco IOS Zone-Based Policy Firewall (ZBFW), what must happen before traffic can flow between two interfaces assigned to different security zones?

   • Both interfaces must be trunk ports that carry the same VLAN, so the zones share a broadcast domain.
   • A zone pair with an inspect policy must link the zones; inter-zone traffic is denied by default.
   • NAT must be disabled globally, because ZBFW cannot inspect flows after their addresses are translated.
   • The interfaces must share one IP subnet so the zones can exchange ARP replies.

4. Which Zone-Based Firewall action allows a Cisco IOS router to track the state of a TCP session and dynamically permit its return traffic without a separate matching ACL entry?

   • pass
   • drop
   • inspect
   • log

5. What is the built-in special zone in Cisco Zone-Based Policy Firewall that represents the router itself, used to control traffic destined to or originating from the device?

   • self zone
   • default zone
   • router zone
   • management zone

6. In a ZBFW policy-map type inspect, what happens by default to traffic that matches no explicitly defined class and falls into class-default?

   • It is inspected statefully, the same as traffic in a class set to inspect.
   • It is dropped, unless the class-default action is changed.
   • It is translated by NAT and then passed without state tracking.
   • It bypasses the zone pair and is forwarded on the routing table.

7. Which capability of a Cisco Next-Generation Firewall (such as Secure Firewall Threat Defense) uses signature and reputation-based inspection to identify and block exploit attempts targeting known software vulnerabilities?

   • Intrusion Prevention System (IPS)
   • Port Address Translation (NAT overload)
   • HSRP interface tracking with preemption
   • Unicast Reverse Path Forwarding (uRPF)

8. In Cisco Secure Firewall Threat Defense (FTD), what construct groups interfaces so that Access Control Policy rules can be applied based on logical zones rather than individual interface names?

   • Security Zones
   • VRF Instances
   • Port-Channel groups
   • Bridge Groups

9. What does Cisco Umbrella's DNS-layer enforcement rely on before a device establishes a TCP or UDP session with a malicious destination?

   • Deep packet inspection of the TCP payload after the session to the destination is open.
   • Umbrella resolvers check the domain against threat intelligence before answering.
   • A locally installed antivirus signature file that lists known malicious IP addresses.
   • An IPsec tunnel to the Umbrella cloud that carries all traffic for full inspection.

10. Which Umbrella component extends DNS and web-layer protection to roaming laptops that are off the corporate network and not behind an on-premises firewall?

    • The Umbrella roaming module in Cisco Secure Client
    • The self zone of a Zone-Based Firewall on the branch router
    • An HSRP virtual IP address shared by the edge routers
    • A site-to-site IPsec tunnel from the branch router

11. What differentiates Cisco NGFW's URL filtering feature from simple domain-based blacklisting on a legacy stateful firewall?

    • It enforces by URL category and reputation, including HTTPS when TLS decryption is on.
    • It works on plaintext HTTP only and cannot apply any policy at all to HTTPS sessions.
    • It replaces the access control policy, so no rules are needed for web traffic.
    • It requires stateful inspection to be disabled on the interfaces it is applied to.

12. Within a Cisco ZBFW configuration, which command creates the directional pairing of a source zone and a destination zone, to which an inspection policy is then attached?

    • zone-pair security <name> source <zone1> destination <zone2>
    • zone-member security <zone> under each interface that joins the zone
    • policy-map type inspect <name> with a class and an action
    • class-map type inspect match-any <name> with match protocol

13. On Cisco Secure Firewall Threat Defense, what is the purpose of File Policy in an Access Control Policy rule?

    • It renames each interface to match the security zone it belongs to, for clearer rules.
    • It checks transferred files for malware (such as AMP lookups) and blocks file types.
    • It configures OSPF route redistribution between the inside and outside zones.
    • It sets the DHCP lease time handed to hosts in each security zone.

14. Why can Application Visibility and Control (AVC) correctly classify an application even when it uses a non-standard or dynamically negotiated port?

    • AVC relies on the destination port in the TCP or UDP header, as listed by IANA.
    • AVC uses NBAR2 deep packet inspection of payload and behavior, not just the port.
    • AVC requires each application to register its port with IANA before it is known.
    • AVC drops traffic on non-standard ports until an administrator approves each application.

15. In a Zone-Based Firewall design, what happens to traffic passing between two interfaces that are members of the exact same security zone?

    • It is dropped by default, the same as traffic between two different zones.
    • It is permitted by default, with no zone pair or policy needed.
    • It must be translated by NAT before it can leave the zone again.
    • It is redirected to the self zone so the router can inspect it.

16. Which Cisco cloud security category best describes Cisco Umbrella when discussed alongside a Next-Generation Firewall in an ENCOR-scope security design?

    • A Secure Internet Gateway (SIG) for internet-bound traffic, wherever the user is.
    • A Layer 2 protocol that prunes VLANs from trunks toward the internet edge.
    • A WAN routing protocol that selects the best internet exit for each branch.
    • A hardware services line card installed in a Catalyst 9400 or 9600 chassis.

17. What must be true for a Cisco IOS router's self zone policy to permit an administrator's SSH session to the router, given that ZBFW is enabled on the router's data interfaces?

    • Self zone traffic is dropped once ZBFW is enabled, so SSH to the router fails.
    • No policy restricts the self zone (default permit), or a self zone pair permits SSH.
    • SSH bypasses ZBFW entirely because it is sourced from the management plane.
    • The self zone must be renamed so it matches the name of the interface the SSH session arrives on.

18. Which type of Cisco NGFW policy component defines matching criteria such as source/destination network, application, URL category, and user identity, then applies an action of allow, block, or trust?

    • Access Control Policy rule
    • Prefix list with permit statements
    • HSRP preemption timer
    • Route map with match ip address

19. In a Cisco ZBFW deployment, which command applies the inspection service policy to a configured zone pair so the policy actually takes effect?

    • service-policy type inspect <policy-map-name> under the zone-pair
    • ip inspect <name> in under each physical interface that is in the zone
    • crypto map <name> under the zone-pair security configuration
    • zone-member security <zone> under the zone-pair configuration

20. Why do modern Next-Generation Firewalls (NGFW) implement SSL/TLS Decryption (SSL Interception) policies?

    • To raise interface throughput by offloading encryption work to dedicated crypto hardware.
    • To expose encrypted payloads to IPS and malware inspection, then re-encrypt them.
    • To let older web browsers keep using SSLv3 safely behind the firewall.
    • To skip TACACS+ authentication checks for users with a valid certificate.