Man, Cisco loves making these Firepower terms confusing. C or D? I keep thinking single deployment (C) could work because it sounds like what you set up at first, and you can still segment with policies, right? But maybe that's missing the real point of isolated virtual devices. Not 100% sure, someone else run into this in lab?

Don't think B is correct here. Single-context just gives you one shared config, so you can't do real segmentation between virtual FTDs. D (multi-instance) is the only mode that supports multiple independent Firepower instances with full isolation, which matches what they're asking for. Saw a similar question on another practice set.

Pretty sure it's D. Multi-instance lets you spin up multiple independent FTD virtual firewalls within the same physical appliance, so you can fully segment traffic as needed. The other options don't allow for real isolation between tenants or networks. Correct me if I'm missing another use case here.

Yeah, sticking with C here. Default retention for SaaS licenses is 90 days, unless you've got an upgraded license or moved to Enterprise, then it changes. I haven't seen any updates from Cisco that would make this wrong. Someone correct me if there's new info?

Anyone else notice the wording? "Default" really points to C here, since 90 days is standard for the SaaS license. Extended retention would need an upgrade. Pretty sure that's what similar exam reports also said.

Had something like this in a mock, C is the default 90 days for SaaS retention. Cisco bumps it up only if you pay for more. Agree?

For me, C for default retention. Cisco's SaaS Security Analytics usually gives you 90 days out of the box, not more unless you buy extras. I think that's still current but let me know if anyone's seen it change recently.

Quick question, does the scenario assume that all Firepower devices are already on a supported version? I think C because "supports all devices on supported versions" seems like the main point. If older versions matter, this could totally switch the answer.

Option A is what I'd pick. After setting up SPAN and the passive interface, you have to apply an intrusion policy so the FTD inspects the mirrored traffic. That's how it works on real gear and matches what I've seen in similar exam questions. Agree?

Option A fits what I've seen in Cisco official guides and lab exercises. Once SPAN and the passive interface are set, configuring the intrusion policy is the step that actually tells FTD to inspect the mirrored traffic. Pretty sure that's the sequence, but if anyone has seen otherwise in recent labs let me know.

I think it needs to be A. Since the passive-interface and SPAN are already done, the FTD is getting a copy of the traffic. But unless you set up an intrusion policy, nothing gets inspected for threats. Not 100% but matches what I've seen in labs. Anyone disagree?

Yeah, has to be B and C. Transparent mode keeps the FTD invisible on the wire and tapemode just listens instead of blocking anything. That's what you'd want for pure intrusion detection without traffic interruption, I think. Anyone see an edge case for A?

D makes sense since excluding NAT devices should cut down on noisy events. But just checking, if the policy was set to "best" for discovery type instead of ALL, would that also reduce this overload?

I don't think it's C here. The dedicated stateful link (B) actually syncs active sessions between chassis for seamless user experience. C is about software version compliance, but that alone won't keep connections alive on failover. B is the one to go for in this scenario.

Had something like this in a mock and B was right. The dedicated stateful link is what keeps session info synced so users don't lose connections during failover. Pretty sure that's the only way to really keep it seamless for end users. Someone let me know if you think otherwise.

B

I see C and B both make sense because software versions do matter, but for truly seamless failover users only notice, official labs and Cisco's Firepower config guide both highlight that you need the dedicated stateful link (B). Anyone double-checked with the latest practice tests? I might be mixing up ASA/Firepower details.

Isn't the real difference here just routed vs transparent mode? Bridge group routing is only supported in routed mode, right? Transparent mode would block that, so C wouldn't fit for this scenario.

Would option C make sense if they were asking about transparent firewall mode instead? Bridge groups in transparent mode seem to handle things differently, so just wondering if that could ever be right.

Yeah, that's B. In routed mode you do get routing between bridge groups, seen this on some practice sets. C is more for transparent mode. Pretty sure this matches official docs but let me know if anyone disagrees.