Exam 300-710 topic 1 question 33 discussion

I think the key here is "access policies" plural. an FTD can support only one access controle policy. The correct answer is C

another tricky question that I don't like. DMZ does NOT mean that we need NAT because internal DMZ without internet access (not NAT) is possible based on question. Thus I will go C

a DMZ concept is partly internal, own by organization. Some set up of organization's web servers that are facing internet reside in DMZ, with NAT configured.

what do they mean by "internal perimeter" firewall? my guess is that it is entirely within the private address space so why would it need NAT? but the word perimeter makes me wonder if the person who wrote this meant it to be a site level Internet edge device and they are just bad at describing things.

With Routed Mode you can have each DMZ with different routing table and unique private IP subnet range, ACP can be used to control traffic between the different DMZs, NAT could be used but is not required in this case.

To support multiple DMZs with unique private IP subnet ranges, the engineer should deploy the firewall in routed mode with access control policies. Therefore, the correct answer is option B. By deploying the firewall in routed mode with access control policies, the engineer can configure the firewall to route traffic between the DMZs and the internal network based on their unique private IP subnet ranges. The access control policies can be used to enforce security policies to control which traffic is allowed between the DMZs and the internal network. This provides a secure and efficient way to manage traffic between the DMZs and the internal network.

Although ACPs seem obvious, the concept of perimeter firewall is generalized as well as the private IP addressing, implying the need for NAT..., as their are no more specific variables.

A perimeter firewall could mean internet but it does not explicit say internet, so does not explicit say a need for NAT. However it does excplicit ask for support of DMZ:s, and you can't have working DMZs without ACPs. You can have working DMZ:s without NAT. I'd go with B.

I think what we need to look at there is how the question is formed, and it says "Firewall" not FTD, og IPS or firepower. So in pure firewall mode, there is no IDS, so we need to assume that a "Perimiter" firewall is connected to the internet, regardles of the "internal" statement. And so we need NAT configured. C is the answer

Correct answer is: B

This is a horrible question... But you cant have NAT without ACP... Since we can't pick two we will have to go with B.... But I dont like it.

Answers with NAT are wrong because it's an INTERNAL firewall, so no public routers are in play, the DMZs are all private ranges, and obscurity of IPs isnt beneficial against insiders. You'll definitely need routed interfaces, and access control policies to prevent unsolicited traffic from DMZ to inside.

I ll go with B , you can have an internal perimeter Firewall with DMZ without NAT but surely ACPs are needed for the low security DMZ zones.

The correct answer is B. With ACP we can control the traffic. C why we need Nat ? Does not make any sense.

I would have gone for B if the answer had said "access control policy". It does however state "access control policies", and having multiple ACPs for one firewall makes no sense. The question is very bad, as we dont know details on the setup, and scenarios without NAT are possible, but I think the answer is C

Why do you need nat in a internal firewall?

C has my final vote of confidence.