What is the role of the casebook feature in Cisco Threat Response?

• A.sharing threat analysts
• B.pulling data via the browser extension
• C.triage automaton with alerting
• D.alert prioritization

Comment: *

Name: *

Email: *

Verification: *

A network engineer is extending a user segment through an FTD device for traffic inspection without creating another IP subnet How is this accomplished on an FTD device in routed mode?

• A.by leveraging the ARP to direct traffic through the firewall
• B.by using a BVI and create a BVI IP address in the same subnet as the user segment
• C.by assigning an inline set interface
• D.by bypassing protocol inspection by leveraging pre-filter rules
  https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/transparent_or_routed_firewall_mode_for_firepower_threat_defense.html

Comment: *

Name: *

Email: *

Verification: *

A network administrator is configuring Snort inspection policies and is seeing failed deployment messages in Cisco FMC. What information should the administrator generate for Cisco TAC to help troubleshoot?

• A.A "troubleshoot" file for the device in question.
• B.A "show tech" file for the device in question.
• C.A "show tech" for the Cisco FMC.
• D.A "troubleshoot" file for the Cisco FMC.

Comment: *

Name: *

Email: *

Verification: *

An engineer must investigate a connectivity issue and decides to use the packet capture feature on Cisco FTD. The goal is to see the real packet going through the Cisco FTD device and see the Snort detection actions as a part of the output. After the capture-traffic command is issued, only the packets are displayed. Which action resolves this issue?

• A.Perform the trace within the Cisco FMC GUI instead of the Cisco FTD CLI.
• B.Use the verbose option as a part of the capture-traffic command
• C.Use the capture command and specify the trace option to get the required information.
• D.Specify the trace using the -T option after the capture-traffic command.

Comment: *

Name: *

Email: *

Verification: *

An administrator needs to configure Cisco FMC to send a notification email when a data transfer larger than 10 MB is initiated from an internal host outside of standard business hours. Which Cisco FMC feature must be configured to accomplish this task?

• A.file and malware policy
• B.application detector
• C.intrusion policy
• D.correlation policy

Comment: *

Name: *

Email: *

Verification: *