What Is the First Step to Replace a Failed Secure Firewall HA Device?
An engineer must replace a Cisco Secure Firewall high-availability device due to a failure. When the replacement device arrives, the engineer must separate the high-availability pair from Cisco Secure Firewall Management Center. Which action must the engineer take first to restore high availability?
Community Insight
The question tests the correct first step in Cisco's HA device replacement workflow, and the trap is selecting a registration or NTP action before separating the existing HA pair.
To replace a faulty Secure Firewall high-availability member, you must first force a break between the HA devices in FMC. This guide confirms why breaking the pair (A) is the required first action before unregistering the failed unit or registering the replacement.
Most learners incorrectly pick unregistering the secondary device (C), because they focus on removing the failed chassis from FMC before breaking HA, which leaves the pair in an inconsistent state.
Community Discussion (2 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Cisco's documented procedure for replacing a faulty unit in a Secure Firewall Threat Defense high-availability pair begins by breaking the HA relationship from FMC. Forcing a break between the devices returns both chassis to standalone mode and clears the HA configuration so FMC no longer manages them as a single pair. Only after that separation can the engineer safely unregister the failed device and register the replacement. Community member donciga confirmed "A is correct" and linked Cisco's replace-faulty-unit support document, while tinyJoe noted that "in any case the first thing to do is break the HA pair." This aligns with the FMC Devices > Device Management Break HA control.Why the Other Options Are Wrong
Option B, registering the secondary device, fails because FMC still has the old HA relationship; registering a new secondary before breaking HA creates a management conflict. Option C, unregistering the secondary device, sounds logical but skips the mandatory break, so the active member remains in a stale HA state and the replacement cannot cleanly form a new pair. Option D, configuring NTP time synchronization, is a necessary prerequisite for HA formation and health later, but it does not separate the existing pair and is not the first action. The exam tests sequence, and Cisco's procedure puts the break before any unregister, register, or time-sync step.Community Comment Notes
The two comments on this item both select A, and they point to authoritative Cisco documentation rather than opinion. tinyJoe explicitly reasons that regardless of which HA unit is being replaced, the first thing to do is break the HA pair. donciga adds a direct "A is correct" verdict and cites the Cisco support article for replacing a faulty unit in a Secure Firewall Threat Defense HA pair. That community consensus supports the vendor-documented first action and matches the answer key used here.Official Reference
- https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/760/management-center-device-config-76/high-availability.html#id_14945
- https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/221097-replace-faulty-unit-in-secure-firewall-t.html
Exam Strategy
Remember the HA replacement sequence: break, unregister faulty, register replacement, re-establish HA. If a question asks for the first step, choose the break action before any registration or time-sync option.
Frequently Asked Questions
Why must I break the HA pair before unregistering the failed Secure Firewall device?
FMC treats the HA pair as one logical device; breaking HA first returns both units to standalone so the failed unit can be unregistered and the replacement can register cleanly.
Can I just configure NTP before breaking HA to restore high availability?
No. NTP synchronization is needed for the replacement to form HA later, but it is not the first action; the existing HA relationship must be broken in FMC before any registration steps.