Which Action Completes L4-L7 Device Object for Single-NIC Routed Firewall?
Refer to the exhibit. An engineer configures a Layer 4 to Layer 7 device object. The device is a virtual firewall with a single network adapter and it must be deployed in routed mode. Which action completes the configuration of the device object? - 
Community Votes
75% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests whether you understand that a routed-mode firewall in ACI needs two cluster interfaces (inside and outside) even when it has only one physical adapter, and the trap is assuming that changing the Function Type to GoTo is sufficient because routed mode maps to GoTo.
Configuring a Layer 4 to Layer 7 device object in Cisco ACI for a virtual firewall with a single network adapter in routed mode requires defining both inside and outside cluster interfaces. This page establishes that the correct action is to add the missing outside interface (D), not to change the function type to GoTo.
The most common wrong answer is B (Change Function Type to GoTo) because candidates associate routed mode with the GoTo function type, but GoTo is the default and the single adapter already requires a second logical interface to be added.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is D: Add an outside interface to the cluster interfaces. In Cisco ACI, a Layer 4 to Layer 7 device object (logical device) for a routed-mode firewall must define at least two cluster interfaces, typically named inside and outside, so that the device can route traffic between them. The question specifies a virtual firewall with a single network adapter, which means both cluster interfaces must be mapped to that same adapter using VLANs or subinterfaces. The exhibit likely shows only one interface (e.g., inside) already configured, so the missing action is to add the outside interface. This is consistent with Cisco's design for single-NIC firewalls in ACI, where the device object must include both interfaces for the service graph to function correctly.Why the Other Options Are Wrong
Option A (Enable Promiscuous Mode) is incorrect because Promiscuous Mode is used for transparent (GoThrough) firewalls or special single-interface deployments, not for routed mode where the firewall acts as the default gateway and traffic is addressed to its MAC. Option B (Change Function Type to GoTo) is wrong because GoTo is the default function type and already corresponds to routed mode; the question states the device must be deployed in routed mode, implying the function type is already correct or not the missing piece. Option C (Change context awareness to Multiple) is irrelevant because context awareness refers to whether the device supports multiple virtual contexts (like multiple virtual firewalls), not to the number of network adapters or routing mode.Community Comment Notes
Community comments reflect a split decision. One commenter, prospio971, correctly lists the function types and notes that "GoTo: Routed mode" and that "The default is GoTo", which supports the idea that changing to GoTo is unnecessary. Another commenter argues that for a single-NIC virtual firewall in routed mode, "the device must have both inside and outside interfaces", which directly points to answer D. Despite the vote majority favoring B, the technical requirement for two cluster interfaces on a single adapter makes D the correct action.Official Reference
Exam Strategy
When answering ACI L4-L7 questions, focus on the specific constraint mentioned (like single network adapter) and how it changes the required configuration. Remember that GoTo is the default for routed mode, so if a question asks what else is needed, look for interface-related actions.
Frequently Asked Questions
Why isn't changing the Function Type to GoTo the correct action?
GoTo is the default function type for routed mode in ACI, so changing it to GoTo is redundant; the missing configuration is the second cluster interface.
Can a single-NIC virtual firewall still be deployed in routed mode in ACI?
Yes, by defining both inside and outside cluster interfaces on the same adapter using VLANs or subinterfaces, which allows the firewall to route traffic.