- (Exam Topic 4)
Which two remediation options are available when Cisco FMC is integrated with Cisco ISE? (Choose two.)

1. A. dynamic null route configured
2. B. DHCP pool disablement
3. C. quarantine
4. D. port shutdown
5. E. host shutdown

Correct Answer: CD
Reference: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/210524-configure- firepower-6-1-pxgrid-remediati.html

- (Exam Topic 5)
A security engineer is deploying a pair of primary and secondary Cisco FMC devices. The secondary must also receive updates from Cisco Talos. Which action achieves this goal?

1. A. Force failover for the secondary Cisco FMC to synchronize the rule updates from the primary.
2. B. Configure the secondary Cisco FMC so that it receives updates from Cisco Talos.
3. C. Manually import rule updates onto the secondary Cisco FMC device.
4. D. Configure the primary Cisco FMC so that the rules are updated.

Correct Answer: D

- (Exam Topic 5)
What is the advantage of having Cisco Firepower devices send events to Cisco Threat response via the security services exchange portal directly as opposed to using syslog?

1. A. Firepower devices do not need to be connected to the internet.
2. B. All types of Firepower devices are supported.
3. C. Supports all devices that are running supported versions of Firepower
4. D. An on-premises proxy server does not need to set up and maintained

Correct Answer: D
Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/integrations/CTR/ Firepower_and_Cisco_Threat_Response_Integration_Guide.pdf

- (Exam Topic 5)
A user within an organization opened a malicious file on a workstation which in turn caused a ransomware attack on the network. What should be configured within the Cisco FMC to ensure the file is tested for viruses on a sandbox system?

1. A. Capacity handling
2. B. Local malware analysis
3. C. Spere analysis
4. D. Dynamic analysis

Correct Answer: D

- (Exam Topic 5)
An engineer must investigate a connectivity issue and decides to use the packet capture feature on Cisco FTD. The goal is to see the real packet going through the Cisco FTD device and see the Snort detection actions as a part of the output. After the capture-traffic command is issued, only the packets are displayed. Which action resolves this issue?

1. A. Use the verbose option as a part of the capture-traffic command
2. B. Use the capture command and specify the trace option to get the required information.
3. C. Specify the trace using the -T option after the capture-traffic command.
4. D. Perform the trace within the Cisco FMC GUI instead of the Cisco FTD CLI.

Correct Answer: B