300-710 Securing Networks with Cisco Firepower (300-710 SNCF) Question and Answers

The capture should be taken on the DMZ interface of the perimeter firewall because this is the firewall interface closest to the affected server. Capturing there shows the packets delivered to the server and the TCP RST packets returned by it. This placement helps determine whether the reset originates from the server, whether address translation changed the connection, or whether the firewall generated or altered the traffic. Capturing only on the internet-facing interface would show the external behavior but provide less certainty about what reached or left the DMZ server. The perimeter router and ISP router are even farther from the suspected source. Cisco troubleshooting guidance recommends capturing as close as possible to the relevant endpoint and on the associated firewall data interface. List B’s supplied answer C is therefore incorrect and has been corrected to D. Cisco firewall capture analysis

================

The Analysis > Hosts > Vulnerabilities page in Cisco FMC displays information about the hosts on the network and their associated vulnerabilities. The administrator can filter the hosts by impact level, which indicates how likely an attack is to succeed against a host. An impact level of 2 means that the host was attacked and is potentially vulnerable, but no exploit was confirmed. The administrator can click on a host to view more details, such as its IP address, operating system, applications, protocols, and intrusionevents. The administrator can also view the details of each vulnerability, such as its CVE ID, description, severity, and recommended actions3

A custom application detector is a user-defined script that can detect web applications, clients, and application protocols based on patterns in network traffic. Custom application detectors are written in LUA, which is a lightweight and embeddable scripting language. LUA scripts can use predefined functions and variables provided by the Firepower System to access packet data and metadata, and to specify the detection criteria and the application information1.

To import a custom application detector file that was provided by a third party, you need to follow these steps1:

In the FMC web interface, navigate to Objects > Object Management > Application Detectors.

Click Import.

Browse to the location of the LUA script file and select it.

Click Upload.

Review the detector details and click Save.

The other options are incorrect because:

Perl script is not a supported format for custom application detectors. Perl is a general-purpose programming language that is not embedded in the Firepower System.

NBAR protocol is not a file type, but a feature of Cisco IOS routers that can classify and monitor network traffic based on application types. NBAR protocols are predefined and cannot be imported as custom application detectors.

Python program is not a supported format for custom application detectors. Python is a general-purpose programming language that is not embedded in the Firepower System.

When replacing a Cisco Secure Firewall high-availability (HA) device due to a failure, the first step the engineer must take is to unregister the secondary (failed) device from the Cisco Secure Firewall Management Center (FMC). This action separates the HA pair and ensures that the new replacement device can be registered and configured correctly.

Steps:

Access the FMC and navigate to the device management section.

Unregister the failed secondary device to remove it from the HA pair.

Register the replacement device to the FMC.

Reconfigure the HA settings to restore the high-availability configuration.

By unregistering the failed device first, the engineer ensures a clean setup for the replacement device, avoiding potential conflicts or issues in the HA configuration.

Cisco Security Analytics and Logging (SaaS) licenses come with a default data retention period of 90 days. This retention period allows organizations to store and analyze their security event data for up to 90 days, providing sufficient time for security monitoring and forensic investigations.

The intended control node should be assigned a numerically lower priority value than the other cluster nodes. Cisco Secure Firewall cluster priority values operate inversely: the lowest numerical value represents the highest election priority. For example, a node configured with priority 1 takes precedence over nodes configured with priorities 10 or 20. If the current control node fails, the available node with the highest priority—meaning the lowest configured number—is elected as the replacement. Values 0 and 255 are outside the documented 1–100 range for this Management Center clustering implementation. Therefore, the node with greater processing resources should receive a lower numerical value. The supplied answer of C in List B is incorrect and has been corrected to B based on Cisco documentation. Cisco Secure Firewall clustering documentation

================

Transparent mode allows the FTD device to act as a “bump in the wire” that does not affect the IP addressing of the network. The end user workstations will not need any changes to their configuration, as they will still receive an IP address from the same DHCP server. However, the FTD device must allow DHCP traffic in the access control policies, otherwise it will block the DHCP requests and replies1

https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/firepower_management_center_high_availability.html

To determine if a host is infected with malware, the network administrator can look at the Indications of Compromise (IOC) feature in Cisco FMC. The IOC feature analyzes network and endpoint data collected by Firepower sensors and AMP for Endpoints connectors, and identifies hosts that exhibit signs of compromise or infection. The IOC feature uses predefined rules based on Cisco Talos intelligence and other sources to detect IOCs on hosts. One of these rules is CnC Connected, which indicates that a host has communicated with a command-and-control (CnC) server that is known to be associated with malware activity2.

To view the IOC information for a host, the network administrator can navigate to Analysis > Hosts > Indications of Compromise in Cisco FMC, and select a host from the table. The IOC Details page will show the IOC events for that host, including the CnC Connected event, along with other information such as severity, timestamp, source, destination, protocol, and rule name. The network administrator can also view more details about each IOC event by clicking on it2.

The other options are incorrect because:

Analysis > Files > Malware Events shows information about files that have been detected as malware by Firepower sensors or AMP for Endpoints connectors. This does not show information about hosts that are infected with malware or have communicated with CnC servers3.

Analysis > Hosts > Host Attributes shows information about hosts that have been discovered by Firepower sensors, such as IP address, MAC address, operating system, applications, users, vulnerabilities, and so on. This does not show information about IOCs or CnC connections on hosts4.

Analysis > Files > Network File Trajectory shows information about files that have traversed your network and have been detected by Firepower sensors or AMP for Endpoints connectors. This allows you to track where a file came from, where it went, and what happened to it along the way. This does not show information about hosts that are infected with malware or have communicated with CnC servers5.

To streamline the process of reviewing events and modifying blocking of specific files across both the firewall console and the endpoint console, the security engineer should initiate the integration between Secure FMC and Cisco Secure Endpoint (formerly AMP for Endpoints) from the Secure FMC using the AMP tab.

Steps:

In the FMC, navigate toDevices > Device Management.

Select the device and go to theAMPtab.

Initiate the integration by configuring the necessary API credentials and linking the FMC to the Cisco Secure Endpoint console.

This integration allows the security engineer to view endpoint events and apply blocking actions directly from the FMC, consolidating the management tasks.

This approach simplifies the workflow by providing a single interface to manage both network and endpoint security, reducing the time and effort required to maintain security across the organization.

To capture packets that are dropped by Cisco Secure Firewall Threat Defense (FTD) and troubleshoot the issue of traffic from the inside network to a webserver not getting through, the administrator should use the command to capture packets dropped by the accelerated security path (ASP) engine. The correct command is:

capture CAP type asp-drop all headers-only

This command captures all packets dropped by the ASP engine, which includes packets that are being blocked by access control policies, NAT issues, or other security checks.

Steps:

Access the FTD CLI.

Run the commandcapture CAP type asp-drop all headers-onlyto capture dropped packets.

Analyze the captured data to identify the cause of the drops.

This command provides detailed information on why packets are being dropped, helping the administrator resolve the issue.

When you configure the Cisco Firepower devices to bypass the access control policies for VPN traffic, the devices will not inspect the VPN traffic and thus will not waste resources on it. This is the best option to ensure that the VPN traffic is not wasting resources on the Cisco Firepower devices.

To ensure that router R2 removes the directly connected route for 192.168.1.0/24 from its routing table when the cable between router R1 and the Secure FTD device is disconnected, the network engineer must implement the " Propagate Link State " option on the Secure FTD device. This option allows the FTD to propagate the link state changes to adjacent devices, ensuring that the disconnection is recognized and the routing table is updated accordingly.

Steps:

Access the FTD device configuration via FMC.

Navigate to the interface settings for the relevant interfaces.

Enable the " Propagate Link State " option for the interfaces connected to R1 and R2.

Deploy the changes to the FTD device.

This configuration ensures that the link state changes are communicated to router R2, prompting it to remove the disconnected route from its routing table.

The default action setting in a Cisco FTD Access Control Policy determines how the system handles and logs traffic that is not handled by any other access control configuration. The default action can block or trust all traffic without further inspection, or inspect traffic for intrusions and discovery data3.

The Trust All Traffic option allows all traffic from an undefined application to pass without Snort inspection. This option also disables Security Intelligence filtering, file and malware inspection, and URL filtering for all traffic handled by the default action. This option is useful when you want to minimize the performance impact of access control on your network3.

The other options are incorrect because:

The Inherit from Base Policy option inherits the default action setting from the base policy. The base policy is the predefined access control policy that you use as a starting point for creating your own policies. Depending on which base policy you choose, the inherited default action setting can be different3.

The Network Discovery Only option inspects all traffic for discovery data only. This option enables Security Intelligence filtering for all traffic handled by the default action, but disables file and malware inspection, URL filtering, and intrusion inspection. This option is useful when you want to collect information about your network before you configure access control rules3.

The Intrusion Prevention option inspects all traffic for intrusions and discovery data. This option enables Security Intelligence filtering, file and malware inspection, URL filtering, and intrusion inspection for all traffic handled by the default action. This option provides the most comprehensive protection for your network, but also has the most performance impact3.

Reason: the command " capture-traffic " is used for SNORT Engine Captures. To capture a LINA Engine Capture, you use the " capture " command. Since the Lina Engine represents the actual physical interface of the device, " capture " is the only reasonable choice Reference:https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/212474-working-with-firepower-threat-defense-f.html#anc10

The command is

firepower# capture DMZ interface dmz trace detail match ip host 192.168.76.14 host 192.168.76.100

firepower# capture INSIDE interface inside trace detail match ip host 192.168.76.14 host 192.168.75.14

Individual intrusion rules do not support direct time-range conditions or scheduled activation triggers. Instead, the administrator creates a time-range object and uses it as a condition in an access control rule. The required intrusion policy is then associated with that access control rule. During the specified time range, matching traffic invokes the intrusion policy and its enabled intrusion rules; outside the range, the access control rule does not match. Multiple access control rules can be created when different intrusion policies or protection levels are needed at different times. Secure Firewall Management Center does not require an external scheduled task to enable and disable individual intrusion rules. Cisco documents time-range objects as the mechanism for making supported policies apply only during defined periods. Therefore, time-based access control rules are the correct implementation. Cisco time-range objects

To allow access to a specific banking site over HTTPS, the network administrator must use SSL decryption (also known as SSL/TLS inspection) and specify the URL. This is because HTTPS traffic is encrypted, and the firewall needs to decrypt the traffic to inspect the URL and enforce the access rule.

Steps:

Enable SSL Decryption: Configure SSL policies to decrypt the HTTPS traffic.

Specify the URL: Define the URL of the banking site in the access control policy, ensuring that the decrypted traffic is inspected and allowed based on the specified URL.

This method ensures that only the desired banking site is accessed over HTTPS, while other HTTPS traffic can be filtered or blocked according to the organization ' s security policies.

An EtherChannel interface is a logical interface that consists of a bundle of individual Ethernet links that act as a single network link. An EtherChannel interface can increase the bandwidth and reliability of a network connection5.

On a Cisco Firepower 9300 appliance registered with an FMC for high availability, the network administrator must create the EtherChannel interface on the FXOS CLI. The FXOS is the operating system that runs on the Firepower 9300 chassis and provides hardware management functions such as interface configuration, power supply status, fan speed control, and so on6.

To create an EtherChannel interface on the FXOS CLI, the network administrator can follow these steps5:

Connect to the FXOS CLI using SSH or console.

Enter scope eth-uplink command to enter Ethernet uplink mode.

Enter create port-channel command to create an EtherChannel interface.

Enter a port-channel ID (1-48) and a mode (on or active) for the EtherChannel interface.

Enter add interface command to add physical interfaces to the EtherChannel interface.

Enter one or more interface IDs (for example, 1/1) for the physical interfaces.

Enter commit-buffer command to save the changes.

The other options are incorrect because:

The FMC CLI does not provide any commands to create an EtherChannel interface on a Firepower 9300 appliance. The FMC CLI is mainly used for managing FMC settings such as backup, restore, upgrade, troubleshoot, and so on7.

The FTD CLI does not provide any commands to create an EtherChannel interface on a Firepower 9300 appliance. The FTD CLI is mainly used for managing FTD settings such as routing, NAT, VPN, access control, and so on8.

The FMC GUI does not provide any options to create an EtherChannel interface on a Firepower 9300 appliance. The FMC GUI is mainly used for managing FTD policies such as access control, intrusion, file, malware, and so on9.

A low-impact attack indicates that the host is not vulnerable to those attacks. A low-impact attack is an attack that does not exploit any known vulnerability on the target host or does not match any signature or anomaly rule on the FTD device5. A low-impact attack does not mean that the attack is not dangerous to the network or that the host is not within the administrator’s environment. It simply means that the attack did not succeed in compromising or affecting the host.

The other options are incorrect because:

All attacks are not listed as low until manually categorized. The FTD device automatically assigns an impact level to each attack based on various factors, such as vulnerability information, threat score, and confidence rating5. The impact level can be high, medium, or low, depending on how likely and how severe the attack is.

The attacks are not necessarily harmless to the network. A low-impact attack may still cause some damage or disruption to the network, such as consuming bandwidth, generating noise, or distracting attention from other attacks6. A low-impact attack may also indicate that the attacker is probing or scanning the network for potential vulnerabilities or weaknesses7.

The host is not necessarily outside the administrator’s environment. A low-impact attack can target any host on the network, regardless of its location or ownership. A low-impact attack does not imply that the host is external or irrelevant to the administrator’s environment.

To ensure high availability of internet access when deploying a pair of Cisco Secure Firewall Threat Defense (FTD) devices managed by Cisco Secure Firewall Management Center (FMC), the following features must be deployed:

Route Tracking:This feature monitors the reachability of a specified target (such as an external IP address) through the configured routes. If the route to the target is lost, the FTD can dynamically adjust the routing to use an alternate path, ensuring continuous internet access.

SLA Monitor:Service Level Agreement (SLA) monitoring works alongside route tracking to continuously verify the status and performance of the internet links. If the SLA for one of the ISP links fails (indicating the link is down or underperforming), the FTD can switch traffic to the secondary ISP link.

Steps to configure:

In FMC, navigate toDevices > Device Management.

Select the FTD device and configure route tracking to monitor the ISP links.

Configure SLA monitors to continuously check the health and performance of the internet circuits.

These configurations ensure that internet access remains available to users even if one of the ISPs goes down.

To integrate a third-party security intelligence feed with Cisco Secure Firewall Management Center (FMC) using Threat Intelligence Director (TID), the following actions are necessary:

Upgrade to version 6.6:The FMC must be running at least version 6.6 to support Threat Intelligence Director. Version 6.2.3 does not support the necessary features for this integration.

Add the URL of the TAXII server:Threat Intelligence Director uses TAXII (Trusted Automated eXchange of Indicator Information) to pull threat intelligence data from third-party sources. The URL of the TAXII server must be added to the TID configuration in FMC.

Steps:

Upgrade FMC to version 6.6 or later.

In FMC, navigate toIntegration > Threat Intelligence Director.

Add a new TAXII server by entering the URL of the TAXII server.

These actions enable the integration of third-party threat intelligence feeds, enhancing the security capabilities of the FMC.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa910/configuration/firewall/asa-910-firewall-config/access-sfr.html

Inline tap monitor-only mode (ASA inline)—In an inline tap monitor-only deployment, a copy of the traffic is sent to the ASA FirePOWER module, but it is not returned to the ASA. Inline tap mode lets you see what the ASA FirePOWER module would have done to traffic, and lets you evaluate the content of the traffic, without impacting the network. However, in this mode, the ASA does apply its policies to the traffic, so traffic can be dropped due to access rules, TCP normalization, and so forth.

SNMP provides nonintrusive, read-only monitoring of Secure Firewall Threat Defense devices and is appropriate for collecting high-level device statistics without interrupting production traffic. An external network management system can poll supported Management Information Base objects to obtain CPU utilization, memory usage, interface statistics, Snort information, process status, high-availability state, and cluster health. SNMP traps can also report important events without requiring continuous manual access to the device. Malware reports focus on malicious files and malware events, while risk reports summarize security risks and attacks. Host reports describe discovered hosts, applications, operating systems, and vulnerabilities rather than overall device performance. Because the requirement concerns device-level statistics and minimizing operational disruption during peak season, SNMP monitoring is the most appropriate choice. Cisco Secure Firewall SNMP monitoring

================

A file policy defines the actions that the Cisco Firepower Threat Defense (FTD) device should take when it encounters different types of files. The file policy is applied as part of an access control policy. If an access control policy does not include a file policy, the FTD device will not take any action on the files it encounters, resulting in a disposition of " unknown " for all file types except exe.

Secure Firewall Management Center evaluates access control entries sequentially from the lowest sequence number to the highest and stops processing after the first match. Because host 10.236.131.1 is contained within network 10.236.131.0/24, the specific host exception must appear before the broader subnet block. Sequence 1 must therefore allow 10.236.131.1, and sequence 2 must block 10.236.131.0/24. If the subnet block were placed first, traffic to 10.236.131.1 would match that entry and never reach the subsequent host allow entry. Cisco recommends placing more specific entries above general entries for exactly this reason. In an access list object, Allow identifies traffic to which the associated service applies, while Block excludes it from that service; it does not necessarily mean the firewall drops the packet. Cisco access-list object documentation

https://www.cisco.com/c/en/us/td/docs/security/firepower/601/configuration/guide/fpmc-config-guide-v601/fpmc-config-guide-v60_chapter_01011010.pdf

When reconfiguring an existing Cisco FTD from transparent mode to routed mode, an additional action that must be taken to maintain communication between the two network segments is toupdate the IP addressing so that each segment is a unique IP subnet. This is because in routed mode, the FTD device acts as a router hop in the network and requires each interface to be on a different subnet. In transparent mode, the FTD device acts as a layer 2 firewall and does not require different subnets for each interface1.

The other options are incorrect because:

Configuring a NAT rule so that traffic between the segments is exempt from NAT is not necessary to maintain communication between the two network segments. NAT is used to translate IP addresses between different networks, but it does not affect the routing of packets. Moreover, NAT is optional in routed mode and can be disabled if not needed2.

Deploying inbound ACLs on each interface to allow traffic between the segments is not required to maintain communication between the two network segments. ACLs are used to control access to network resources based on source and destination addresses, protocols, and ports. They do not affect the routing of packets. Furthermore, ACLs are optional in routed mode and can be configured as needed3.

Assigning a unique VLAN ID for the interface in each segment is not relevant to maintain communication between the two network segments. VLANs are used to create logical groups of hosts that share the same broadcast domain, regardless of their physical location or connection. They do not affect the routing of packets. Besides, VLANs are not supported in routed mode and can only be used in transparent mode4.

To configure URL filtering for a Cisco FTD device in Cisco FMC, and to meet the requirements of the question, the engineer must do the following:

On the HTTP Responses tab of the access control policy editor, set the Interactive Block Response Page to system-provided. This will enable the system to display a warning page to the users when they try to access a blocked URL, and give them the option to continue or cancel. The system-provided page is a default page that contains a generic message and a logo1.

Configure an access control rule that matches an URL object for http://www.badadultsite.com; and set the action to Interactive Block. This will apply the interactive block action to the specific URL that is defined in the URL object. The interactive block action will trigger the interactive block response page that was configured in the previous step1.

The other options are incorrect because:

On the HTTP Responses tab of the access control policy editor, setting the Block Response Page to Custom will not affect the interactive block action. The block response page is used when the action is set to Block, not Interactive Block1.

Configuring the default action for the access control policy to Interactive Block will apply the interactive block action to all URLs that are not matched by any access control rule. This will not meet the requirement of blocking no other websites1.

Configuring an access control rule that matches the Adult URL category and sets the action to Interactive Block will apply the interactive block action to all URLs that belong to the Adult category. This will not meet the requirement of blocking only http://www.badadultsite.com1.

Name → HTTP-HTTPS-QoS

Apply QoS On → Interfaces in Destination Interface Objects

Download/Upload Limit → 5 Mb/s

Source Interface Networks → 192.168.1.0/24

Destination Interface Networks → 192.168.2.0/24

Destination Ports → HTTP-HTTPS

The HR workstation resides on the inside 192.168.1.0/24 network, making that subnet the source-interface network. Internet-bound traffic exits through the 192.168.2.0/24 network, which must be configured as the destination-interface network. Because rate limiting must occur as traffic leaves toward the internet, QoS is applied to interfaces in the destination interface objects. The HTTP-HTTPS object identifies the destination ports for web traffic, while HTTP-HTTPS-QoS provides a descriptive rule name. Both download and upload limits are configured as 5 Mb/s. Cisco Secure Firewall applies a QoS limit independently on each selected interface and determines upload and download direction based on the connection initiator. The Apply QoS On selection must correspond to a populated source or destination interface condition. Cisco Secure Firewall QoS configuration

In a local SPAN configuration, the source is the switch interface whose traffic must be copied, while the destination is the interface connected to the passive monitoring device. Therefore, switch interface Gi0/1 must be configured as the SPAN source, and switch interface Gi0/3, which connects to the Cisco Secure IPS sensor, must be the destination. Both commands must also reference the same SPAN session number. Option D satisfies all these requirements. Options B and C omit the mandatory session number, while Option A incorrectly assigns Gi0/3 as both the source and destination. A SPAN destination cannot simultaneously be a source in the same session. The passive IPS receives the mirrored packets for inspection but does not retransmit or directly block them. Cisco SPAN configuration documentation

In the integration between Cisco Identity Services Engine (ISE) and Cisco Firewall Management Center (FMC), realms are used to define the Active Directory (AD) configuration. Realms in FMC specify the AD servers, domain, and other authentication settings necessary to authenticate and authorize users.

Steps to configure realms:

In FMC, navigate toSystem > Integration > Realms and Directory.

Add a new realm and configure the AD settings.

Ensure the realm settings match the AD environment for seamless integration.

Realms are essential for integrating AD with FMC, allowing the firewall to use AD for user authentication and policy enforcement.

The Encrypted Visibility Engine (EVE) in Cisco Secure Firewall Management Center is enabled under the SSL tab of an access control policy. EVE provides visibility into encrypted traffic, allowing the firewall to detect threats even when traffic is encrypted.

Steps to enable EVE:

Navigate to the access control policy in FMC.

Go to theSSLtab.

Enable Encrypted Visibility Engine (EVE) to analyze encrypted traffic.

This configuration helps in identifying and mitigating threats within encrypted traffic without the need for full decryption.

https://www.cisco.com/c/en/us/td/docs/security/firepower/623/fdm/fptd-fdm-config-guide-623/fptd-fdm-intrusion.html

The content keyword is used to specify a string or pattern to search for in the payload or stream of a packet. The string must be enclosed in quotation marks and can use modifiers such as nocase, depth, offset, and so on. The string can also use hexadecimal notation by using a pipe symbol (|) before and after the hexadecimal characters. For example, content: " |45 5* 26 27 4 0A| " will match any payload or stream that contains the hexadecimal bytes 45 5 26 27 4 0A followed by any number of bytes2

To ensure that VoIP traffic in a contact center is not impacted by performance issues after deploying an access control policy on a Cisco Secure Firewall Threat Defense (FTD) device, the engineer should configure the access control rule with the " trust " action. The " trust " action allows traffic to bypass inspection and policy enforcement, ensuring that critical VoIP traffic is not delayed or degraded.

Steps:

In FMC, navigate toPolicies > Access Control > Access Control Policy.

Create a new rule or edit an existing rule.

Set the source and destination for the VoIP traffic.

Set the action to " trust " to ensure the VoIP traffic is not inspected.

By configuring the rule with the " trust " action, the VoIP traffic will be prioritized, maintaining the quality and performance required for the contact center operations.

To add a Cisco Secure Firewall Threat Defense (FTD) device to Cisco Secure Firewall Management Center (FMC), the correct command to use isconfigure manager add 192.168.75.201 < reg_key > . This command registers the FTD device with the FMC using the FMC ' s IP address and the registration key provided during the FMC setup.

Command structure:

configure manager add < FMC_IP > < reg_key >

For the given scenario:

FMC IP address: 192.168.75.201

Registration key: provided during FMC setup

Thus, the correct command is:

configure manager add 192.168.75.201 < reg_key >

To enable Cisco Secure Firewall Malware Defense to detect and block malware, the network administrator must associate a File policy with an access control policy. File policies allow administrators to configure malware detection and file analysis capabilities on the Cisco Secure Firewall Threat Defense appliance.

Steps to configure File policy:

Navigate toPolicies > Access Control > File Policiesin the FMC.

Create a new file policy or edit an existing one to include malware detection and blocking settings.

Associate the file policy with the relevant access control policy.

Ensure that the access control policy is deployed to the FTD appliance.

By associating a file policy, the firewall will inspect files being transmitted through the web server for malware and take appropriate actions (block, allow, or alert) based on the configured rules.

Step 1(Configure the primary unit for high availability),

Step 2(Configure the secondary unit for high availability),

Step 3(Configure the two units for high availability),

Step 4(Configure failover criteria for health monitoring)

4, 1, 2, 3

To connect to a Secure Endpoint private cloud instance from Cisco Secure Firewall Management Center (FMC), the network engineer requires the SSL certificate for the Secure Endpoint private cloud instance. This SSL certificate is necessary to establish a secure, trusted connection between the FMC and the private cloud instance.

Steps:

Obtain the SSL certificate from the server administrator.

Import the SSL certificate into the FMC.

Configure the connection to the Secure Endpoint private cloud instance using the provided hostname and SSL certificate.

This ensures a secure and authenticated connection to the private cloud instance.