Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Implementing and Operating Cisco Security Core Technologies (SCOR) · Cisco
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Cisco ASA (Adaptive Security Appliance): Default behavior: All interfaces are untrusted by default, and all traffic is denied Cisco IOS Router with Zone-Based Policy Firewall (ZBFW): Default behavior: Traffic between zones is permitted unless explicitly denied, depending on the policy maps.
Cisco ASA supports clustering and stateful failover, while the Cisco IOS ZBFR is not able to produce a true HA in terms of firewalling. Answer D is not correct due to the fact that Cisco IOS ZBFR is not blocking ALL traffic by default, allowing same-zone inter interface flows. Cisco ASA, on the other hand, will allow by default traffic from high to low security level interfaces but blocking same level interface traffic. C is not right because Cisco IOS ZBFR is blocking all intra-zones trraffic. B is not correct because Cisco ASA CAN be configured and was designed with HA in mind. It remains A, as a functional difference between these 2 type of devices: ASA can function as part of a Cluster while Cisco IOS not. While you can use NHRP on routers or interfaces redundancy, propagating state of the connections to provide HA for clients won't be possible in case of IOS
The ASA enforces a global implicit deny, while ZBFW only controls traffic between defined zones. Untrusted interfaces (not in any zone) on a router with ZBFW will allow traffic until explicitly placed in a zone and governed by policies. So, I vote for C.