Cisco FMC and ISE Integration Quiz

pxGrid is a protocol used to integrate Cisco ISE and FMC, enabling Rapid Threat Containment (RTC) by sharing data and coordinating actions between the two platforms. It allows for rapid response to security threats and provides a unified security posture across the network.

Cisco Threat Intelligence Director supports SHA-256 as the highest level of cryptographic hashing for analyzing threat intelligence feeds and data. It supports Secure Hash Algorithm (SHA) up to SHA-256, ensuring a higher level of security and integrity in handling threat information.

pxGrid is a protocol that allows for communication and data exchange between Cisco security devices, enabling features like Rapid Threat Containment. It provides a network for secure communication, ensuring that threat information can be rapidly shared among various devices.

Enabling Cisco FTD clustering offers high availability and redundancy for your security infrastructure. If the master unit (primary controller) in the cluster fails, the standby unit seamlessly takes over, ensuring failover and minimal downtime.

You cannot add host profile qualifications to a correlation rule that is triggered by a malware event. Correlation rules are powerful ways to define conditions based on various event types (like malware, intrusion, or security events). However, host profile qualifications are not applicable when the rule is specifically triggered by a malware event.

A correlation policy configuration in Cisco Firepower Management Center (FMC) allows you to define actions (e.g., blocking, alerting) based on specific security events. While the system displays correlation policies created across multiple domains, deleting a response group only affects the responses associated with that group.

A Cisco feature that allows multiple physical interfaces to be part of the same VLAN, enabling Layer 2 switching between interfaces including subinterfaces.

A feature that allows administrators to set limits on how frequently events from specific sources or destinations are logged and displayed within a specified time period.

Access Control Policies (ACPs) can operate based on Security Intelligence data, which allows for blocking traffic based on known malicious patterns.

When changes are deployed to the system, the intrusion detection system (SNORT) can restart, causing temporary interruptions in traffic inspection.

The primary function of Cisco AMP Threat Grid is to analyze malware in real time. It uses cloud-based technology to identify and classify threats.

A feature that allows for customized security rules to be applied to different traffic types. This is useful for tailoring security measures based on specific network requirements.

In Cisco FTD, when a new master unit is elected, only existing VPN connections are maintained, ensuring seamless transition without disruption.

Bridge-group interfaces in Cisco FTD allow transparent firewall mode, where traffic is not routed through the FTD but is inspected for security.

The command to associate an FTD unit with an FMC manager is configure manager add followed by the manager's IP address and registration key.

In access control policy rules in Cisco FTD, Block with Reset and Monitor are valid actions. 'Block with Reset' completely stops traffic and resets TCP connection, while 'Monitor' logs traffic without blocking it.

Cisco Firepower Threat Defense (FTD) supports Equal Cost Multipath (ECMP) routing, allowing up to three equal cost paths across multiple interfaces or a single interface.

In Cisco FTD, Bidirectional Forwarding Detection (BFD) echo packets are allowed through the FTD when using bridge-group members, ensuring network connectivity and fault detection.

In Cisco FTD, the BVI IP address for bridge-group interfaces must be in a separate subnet from the connected network to avoid IP address conflicts.

Cisco Firepower Threat Defense (FTD) supports both BGPv4 and BGPv6 routing protocols, allowing for complex network routing configurations.

A Cisco Firepower Management Center (FMC) configuration where all intrusion prevention rules are disabled. This is typically used as a baseline configuration for testing or creating a new deployment.

A Cisco Firepower Management Center (FMC) configuration focused on maximizing detection of potential threats, even if this results in a higher number of false positives. It is often used for testing or in environments with high security demands.

A Cisco Firepower Management Center (FMC) configuration prioritizing security over network performance. It implements a broader range of intrusion prevention rules, accepting the risk of some false positives.

The process of directing traffic to Cisco Firepower for inspection. This is how IPS rules are applied.

A network analysis policy governs how traffic is decoded and preprocessed for further evaluation. This helps systems recognize and respond to abnormal network behavior.

A feature in Cisco Firepower that enables the application of intrusion prevention rules to specific traffic flows. This ensures that security is applied only to the traffic you want to protect.

A Cisco Firepower Management Center (FMC) configuration that allows the system to identify and respond to security events, such as intrusion attempts or malware infections. This allows for proactive threat mitigation through blocking traffic, triggering alerts, or other automated responses.

A security measure focused on minimizing network downtime by storing backup configurations of Cisco FMC managed devices. This allows the system to restore a full configuration quickly in case of a failure.

This type of rule applies only to traffic that matches the rule, but allows all traffic except prohibited files, malware, intrusions, and exploits, which are then blocked. This rule also enforces identity requirements and rate limiting.

When you want to configure an Allow rule to only perform specific actions, such as file inspection or intrusion inspection, you have the option to selectively configure these actions.

A security appliance that provides a virtualized sandbox environment to analyze suspicious files and mitigate threats.

The process of running a suspicious file in a controlled environment to observe its behavior and determine if it is malicious.

This setting lets you analyze files for malware directly on the Cisco FMC device without relying on a sandbox system. This can provide faster malware detection, but may not be as thorough as dynamic analysis.

A feature in Cisco FMC that allows you to see which devices are on your network by analyzing network traffic and device behavior.

Devices like load balancers and NAT devices can generate a high volume of network traffic, especially during updates, potentially overwhelming the Cisco FMC with events. Excluding them from network discovery can reduce this load.

When configuring SNORT inspection policies in the Cisco FMC, it's possible to encounter deployment failures. This can be caused by various factors such as network connectivity issues, incorrect configuration, or insufficient resources. Checking the Cisco FMC logs and reviewing the deployment process to troubleshoot the specific error message is important for resolving these issues.

The local device time in the Firepower Management Center is based on the configured time zone and adjusts automatically for daylight saving time (DST). However, scheduled tasks spanning DST transitions do not adjust their execution time accordingly.

If the Firepower Threat Defense (FTD) device cannot load all Security Intelligence (SI) events, it may result in traffic not being blocked as expected. To fix this, redeploy the configuration to allocate more memory specifically to the SI module.

To allow access to a specific website (172.1.1.50) on port 80 while blocking access to other websites, create an Access Control Policy rule. This rule should allow traffic on port 80 only from the specified IP address.

The Firepower Management Center automatically adjusts its local time display for daylight saving time (DST), where appropriate. However, recurring tasks that span the transition dates from DST to standard time and back do not adjust for the transition. This means that a task scheduled for 2:00 AM during standard time, will run at 3:00 AM during DST, and vice versa.

To configure the system clock settings to use NTP, ensure that the NTP server is reachable and configured. Then, you can select the NTP option under system configuration. After making the change, verify that the system clock is synchronized with the NTP server for accurate timekeeping.

Redeploying configurations to affected devices can help to ensure that the SI module receives enough memory to correctly load all SI event entries. This can be necessary when the FTD device is unable to load all of the SI event entries, preventing traffic from being blocked as expected.

Access control policy rules govern traffic flow based on specific criteria, such as the source and destination IP addresses, ports, and protocols. These rules are an effective way to selectively allow or block access to individual websites without impacting other web communication.

Security Intelligence (SI) events are valuable for identifying and responding to security threats. They contain information about known malware, vulnerabilities, and malicious actors. The Firepower Management Center uses these events to block malicious traffic and enhance overall security posture. Ensure that the FTD device has enough memory to handle all SI event entries.