Exam 300-710 topic 1 question 138 discussion

2 Options: On the FTD devices in the HA pair, configure interfaces to handle traffic for each department’s VLAN: *Option 1: Subinterfaces for VLANs If the FTD is connected to a trunk port, configure subinterfaces on a physical interface for each VLAN. Example: Interface GigabitEthernet0/0.10 for VLAN 10 (Department A) Interface GigabitEthernet0/0.20 for VLAN 20 (Department B) Interface GigabitEthernet0/0.30 for VLAN 30 (Department C) Assign IP addresses to each subinterface in the corresponding subnet (e.g., 192.168.10.1 for VLAN 10). *Option 2: Separate Physical Interfaces If each department’s traffic arrives on a dedicated physical interface, configure those interfaces with the appropriate IP addresses and security zones. Sorry, but have to go against the grain on this one. I choose C.

This is a very unclear question, but I guess it would be D. I assume that the author's intended configuration is similar to the “Network Diagram” in the following document: https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-management-center-virtual/221625-configure-ftd-multi-instance-high-availa.html#toc-hId--1943291811 We will configure an HA with two FTDs, each with two instances. Then, for instance A, Unit 1 is Active - Unit 2 is Passive, and for instance B, Unit 1 is Passive - Unit 2 is Active. In this way, even with Active/Passive HA, the “both firewalls are passing traffic” requirement of the question can be satisfied.

segmentation means separation. Redundant interface is backup, not separation. EtherChannel is to bump up throughput and redundant path. HA active/standby - does NOT allow both firewalls passing traffic