Exam 300-610 topic 1 question 172 discussion

Actual exam question from Cisco's 300-610

Question #: 172
Topic #: 1

Refer to the exhibit.

The security team created a new security policy that requires certain types of traffic to be subject to deep packet inspection. The traffic types are:

• internet traffic to application servers
• internet traffic to corporate users
• partner network traffic to application servers
• partner network traffic to corporate users

Where must the next-generation firewalls be inserted to implement the new policy?

A. inline insertion between the user network switch cluster and the core cluster
B. inline insertion between the edge router cluster and the core switch cluster
C. one-armed insertion from the core switch cluster
D. one-armed insertion from the ACI border leaf cluster

Show Suggested Answer

Suggested Answer: C 🗳️

by muzz40000 at Aug. 13, 2023, 9:06 a.m.

Comments

Submit Cancel

alfred12

Highly Voted 1 year, 8 months ago

Selected Answer: C

but how do you filter traffic from partner users, using the B option?

upvoted 5 times

...

lurker8000

Most Recent 7 months, 1 week ago

Agree with C, for the same reason Alfred12 said, Partner to App and Partner to corp needs inspection which will not happen on core to edge FW enforcement

upvoted 1 times

...

Wasamela

11 months, 2 weeks ago

Selected Answer: B

Answer should be B, inserting the firewall between the edge router cluster and the core switch cluster, to inspect all the specified traffic types for DPI.

upvoted 1 times

...

muzz40000

1 year, 10 months ago

Selected Answer: B

B seems to be the correct answer. However, I think having the firewall in the ACI boder leaf can work, if you want to route traffic from there but no the best option

upvoted 1 times

...