- (Exam Topic 5)
The CEO ask a network administrator to present to management a dashboard that shows custom analysis tables for the top DNS queries URL category statistics, and the URL reputation statistics.
Which action must the administrator take to quickly produce this information for management?

1. A. Run the Attack report and filter on DNS to show this information.
2. B. Create a new dashboard and add three custom analysis widgets that specify the tables needed.
3. C. Modify the Connection Events dashboard to display the information in a view for management.
4. D. Copy the intrusion events dashboard tab and modify each widget to show the correct charts.

Correct Answer: B

- (Exam Topic 2)
An organization does not want to use the default Cisco Firepower block page when blocking HTTP traffic. The organization wants to include information about its policies and procedures to help educate the users whenever a block occurs. Which two steps must be taken to meet these requirements? (Choose two.)

1. A. Modify the system-provided block page result using Python.
2. B. Create HTML code with the information for the policies and procedures.
3. C. Edit the HTTP request handling in the access control policy to customized block.
4. D. Write CSS code with the information for the policies and procedures.
5. E. Change the HTTP response in the access control policy to custom.

Correct Answer: BE

- (Exam Topic 5)
With a recent summer time change, system logs are showing activity that occurred to be an hour behind real time Which action should be taken to resolve this issue?

1. A. Manually adjust the time to the correct hour on all managed devices
2. B. Configure the system clock settings to use NTP with Daylight Savings checked
3. C. Manually adjust the time to the correct hour on the Cisco FMC.
4. D. Configure the system clock settings to use NTP

Correct Answer: B

- (Exam Topic 1)
A network engineer implements a new Cisco Firepower device on the network to take advantage of its intrusion detection functionality. There is a requirement to analyze the traffic going across the device, alert on any malicious traffic, and appear as a bump in the wire How should this be implemented?

1. A. Specify the BVl IP address as the default gateway for connected devices.
2. B. Enable routing on the Cisco Firepower
3. C. Add an IP address to the physical Cisco Firepower interfaces.
4. D. Configure a bridge group in transparent mode.

Correct Answer: D
Traditionally, a firewall is a routed hop and acts as a default gateway for hosts that connect to one of its screened subnets. A transparent firewall, on the other hand, is a Layer 2 firewall that acts like a “bump in the wire,” or a “stealth firewall,” and is not seen as a router hop to connected devices. However, like any other firewall, access control between interfaces is controlled, and all of the usual firewall checks are in place. Layer 2 connectivity is achieved by using a "bridge group" where you group together the inside and outside interfaces for a network, and the ASA uses bridging techniques to pass traffic between the interfaces. Each bridge group includes a Bridge Virtual Interface (BVI) to which you assign an IP address on the network. You can have multiple bridge groups for multiple networks. In transparent mode, these bridge groups cannot communicate with each other.
https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/general/asa-97-general-config/intro-fw.

- (Exam Topic 5)
While integrating Cisco Umbrella with Cisco Threat Response, a network security engineer wants to automatically push blocking of domains from the Cisco Threat Response interface to Cisco Umbrella. Which API meets this requirement?

1. A. investigate
2. B. reporting
3. C. enforcement
4. D. REST

Correct Answer: D