When replacing a Cisco Secure Firewall high-availability (HA) device due to a failure, the first step the engineer must take is to unregister the secondary (failed) device from the Cisco Secure Firewall Management Center (FMC). This action separates the HA pair and ensures that the new replacement device can be registered and configured correctly.
Steps:
* Access the FMC and navigate to the device management section.
* Unregister the failed secondary device to remove it from the HA pair.
* Register the replacement device to the FMC.
* Reconfigure the HA settings to restore the high-availability configuration.
By unregistering the failed device first, the engineer ensures a clean setup for the replacement device, avoiding potential conflicts or issues in the HA configuration.
References: Cisco Secure Firewall Management Center Administrator Guide, Chapter on High Availability Configuration.

To create a malware and file policy on a Cisco Secure Firewall Threat Defense (FTD) device that ensures PDF, DOCX, and XLSX files are not sent to Cisco Secure Malware Analytics, the security engineer must configure local malware analysis. Local malware analysis allows the FTD to inspect and analyze files locally without sending them to the cloud-based Cisco Secure Malware Analytics.
Steps to configure local malware analysis:
* In FMC, navigate to Policies > Access Control > Malware & File Policies.
* Create a new malware and file policy or edit an existing one.
* Define rules to inspect specific file types, ensuring that PDF, DOCX, and XLSX files are handled locally.
* Set the action for these file types to "Local Analysis."
* Apply the policy to the relevant access control policy.
This configuration ensures that the specified file types are analyzed locally, meeting the requirement to avoid sending them to Cisco Secure Malware Analytics.
References: Cisco Secure Firewall Management Center Configuration Guide, Chapter on Malware and File Policies

The Interface Traffic widget belongs to the Operations category because it displays operational information about appliance interfaces, specifically received and transmitted traffic rates. After selecting Add Widgets, the engineer can select All Categories and open Operations to locate Interface Traffic, then click Add next to the widget. Analysis & Reporting contains widgets based on collected security events and analytical data.
Miscellaneous contains widgets that display neither event nor operational data, such as the RSS Feed widget.
"New" is not a valid predefined widget category. Cisco classifies Operations widgets as those that display system status and overall health information. The Interface Traffic widget is not included on predefined dashboards by default, so it must be added manually using this procedure. Cisco Secure Firewall dashboard documentation

In a failover configuration with Cisco Secure Firewall Threat Defense (FTD) devices, ensuring that users on the internal network can continue to communicate with outside devices if the primary device (FTD1) fails requires the implementation of a stateful failover link. The stateful failover link allows the secondary device (FTD2) to maintain session information and state data, ensuring seamless failover and minimizing disruptions.
Steps to implement a stateful failover link:
* Physically connect a stateful failover link between FTD1 and FTD2.
* Configure the stateful failover link in the FMC.
* Ensure that both devices are properly synchronized and that stateful failover is enabled.
* Deploy the changes to both FTD devices.
By configuring a stateful link, the secondary FTD can take over active sessions without requiring users to re- establish their connections, thus ensuring continuous communication.
References:Cisco Secure Firewall Threat Defense Configuration Guide, Chapter on Failover Configuration.

Cisco Security Analytics and Logging (SaaS) licenses come with a default data retention period of 90 days.
This retention period allows organizations to store and analyze their security event data for up to 90 days, providing sufficient time for security monitoring and forensic investigations.
References: Cisco Security Analytics and Logging Documentation, Chapter on License Information and Data Retention.