Exam 300-710 topic 1 question 160 discussion

To meet the requirements of presenting the internal IP subnet as a different IP address while enforcing policy, the engineer needs to configure the Cisco FTD firewall with NAT. Option A is the correct answer: Configure the Cisco FTD firewall in routed mode with NAT enabled. Option D is also not the best solution because it would require configuring the downstream router to perform NAT, which may not be desirable or feasible in some environments.

It reads like this is an edge firewall so A.

When they say single IP subnet, I think they mean a single network, so they are looking for transparent.

Im not happy with this statement ''P subnet to the outside as a different IP address''

C. does not make any sense, just think about it for a second, if you have the same single subnet on both side of the FTD, why would you want to do NAT? The questions even states that "There is a requirement to present the internal IP subnet to the outside as a different IP address", so it needs to be a different IP address. FTD in routed mode with NAT enabled will accomplish this.

I am leaning towards A, they mention internal & outside networks in the question indicating that this could be on the Internet edge? If there were an edge router acting as CPE then I would say transparent but who is directly connected to the outside network?.

I agree is a sh*** cisco question but the answer is simple - only A meets the requirement. C do not make sense to me ?

Cisco being Cisco.... What a shitty question. The key here is one subnet. That means transparet firewall mode, and BVI will acts as proxy arp for that NAT-ed IP.

Typical cisco, trying to complicate simple question. Instead of . The firewall in in routed/Transparent mode, they say An engineer wants to connect a single IP subnet THROUGH a Cisco FTD firewall and enforce policy. In my opinion that means transparent mode.

maybe A? A. Configure the Cisco FTD firewall in routed mode with NAT enabled. To meet the requirements of presenting the internal IP subnet to the outside as a different IP address and enforcing policy, the Cisco FTD firewall should be configured in routed mode with Network Address Translation (NAT) enabled. This will allow the firewall to perform the necessary IP address translation while enforcing security policies on traffic passing through it. Configuring the upstream or downstream router to perform NAT would not allow for policy enforcement by the Cisco FTD firewall. Configuring the Cisco FTD firewall in transparent mode would not allow for IP address translation

Only C makes sense.

Based on the below comment and reading the manual, I think C is more appropriate.

I vote C https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/network_address_translation_nat_for_firepower_threat_defense.html#ID-2091-0000034e