Exam 300-710 topic 1 question 274 discussion

It's very difficut to choose, I would choose A. As for D, this FTD is already in Routed mode. I don't think changing it to Transparent is the best solution, since I assume it is already connected to multiple IP subnets. As for B, the configuration to IP addresses to the BVI is mandatory regardless of whether or not there is separation from routing. As for C, I don't understand what you mean by “IP routing must be removed”. Supplementary, the best solution is “not assigning a name to the BVI interface”. I don't understand why this is not an option. https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/760/management-center-device-config -76/device-ops-tfw.html?bookSearch=true#:~:text=not%20assigning%20a%20name

Routed mode and bvi with IP address = traffic is allowed only between member interfaces ( L2 ). Routed mode and bvi with IP an NAMEIF = traffic is allowed only between member interfaces as well as routed interfaces. Nameif is enabling the routing from BVI to other L3 interfaces

"How to Manage Overlapping Segments in Routed Firewall Mode with BVI Interfaces" In the following example, BVI-G is configured in VRG and Bridge Group 1 is the routed interface for interfaces G0/1 and G0/2. Similarly, BVI-B is configured in VRB and Bridge Group 2 is the routed interface for interfaces G0/3 and G0/4. Consider that both BVIs have the same IP subnet address, say 10.10.10.5/24. Because of virtual routers, the network is isolated on the shared resources. https://www.cisco.com/c/dam/en/us/td/i/400001-500000/440001-450000/442001-443000/442782.jpg https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/virtual-routing-for-firepower-threat-defense.html

I believe D is the correct answer given the below https://www.cisco.com/c/en/us/td/docs/security/firepower/610/configuration/guide/fpmc-config-guide-v61/fpmc-config-guide-v61_chapter_01110000.html#ID-2106-00000036 Bridge Groups in Transparent Firewall Mode Bridge group traffic is isolated from other bridge groups; traffic is not routed to another bridge group within the Firepower Threat Defense device, and traffic must exit the Firepower Threat Defense device before it is routed by an external router back to another bridge group in the Firepower Threat Defense device.

I’m thinking A. Creating a VRF with just the BVI would effectively isolate it from routing.