An engineer is implementing Cisco FTD in the network and is determining which Firepower mode to use. The organization needs to have multiple virtual Firepower devices working separately inside of the FTD appliance to provide traffic

segmentation.

Which deployment mode should be configured in the Cisco Firepower Management Console to support these requirements?

A. Multiple Deployment

B. single-context

C. Single deployment

D. multi-instance

An analyst is reviewing the Cisco FMC reports for the week. They notice that some peer-to- peer applications are being used on the network and they must identify which poses the greatest risk to the environment. Which report gives the analyst this information?

A. Attacks Risk Report

B. User Risk Report

C. Network Risk Report

D. Advanced Malware Risk Report

A security analyst must create a new report within Cisco FMC to show an overview of the daily attacks, vulnerabilities, and connections. The analyst wants to reuse specific dashboards from other reports to create this consolidated one. Which action accomplishes this task?

A. Create a new dashboard object via Object Management to represent the desired views.

B. Modify the Custom Workflows within the Cisco FMC to feed the desired data into the new report.

C. Copy the Malware Report and modify the sections to pull components from other reports.

D. Use the import feature in the newly created report to select which dashboards to add.

Due to an Increase in malicious events, a security engineer must generate a threat report to include intrusion events, malware events, and security intelligence events. How Is this information collected in a single report?

A. Run the default Firepower report.

B. Export the Attacks Risk report.

C. Generate a malware report.

D. Create a Custom report.

An administrator configures new threat intelligence sources and must validate that the feeds are being downloaded and that the intelligence is being used within the Cisco Secure Firewall system. Which action accomplishes the task?

A. Look at the connection security intelligence events

B. Use the source status indicator to validate the usage

C. View the threat intelligence observables to see the downloaded data

D. Look at the access control policy to validate that the intelligence is being used