What Is the First Step to Replace a Failed Secure Firewall HA Device?

300-710 By islever Editorial Last updated

Implement high availability options Configure devices using Secure Firewall Management Center

Short answer

A Force a break between the high-availability devices in Cisco Secure Firewall Management Center before unregistering or registering any device.

Question

An engineer must replace a Cisco Secure Firewall high-availability device due to a failure. When the replacement device arrives, the engineer must separate the high-availability pair from Cisco Secure Firewall Management Center. Which action must the engineer take first to restore high availability?
  1. Force a break between the devices. Correct Answer
  2. Register the secondary device.
  3. Unregister the secondary device.
  4. Configure NTP time synchronization.

Key Takeaways

The question tests the correct first step in Cisco's HA device replacement workflow, and the trap is selecting a registration or NTP action before separating the existing HA pair.

To replace a faulty Secure Firewall high-availability member, you must first force a break between the HA devices in FMC. This guide confirms why breaking the pair (A) is the required first action before unregistering the failed unit or registering the replacement.

Common mistake: Most learners incorrectly pick unregistering the secondary device (C), because they focus on removing the failed chassis from FMC before breaking HA, which leaves the pair in an inconsistent state.

Expert Analysis

Why the Answer Is Correct

Cisco's documented procedure for replacing a faulty unit in a Secure Firewall Threat Defense high-availability pair begins by breaking the HA relationship from FMC. Forcing a break between the devices returns both chassis to standalone mode and clears the HA configuration so FMC no longer manages them as a single pair. Only after that separation can the engineer safely unregister the failed device and register the replacement. Community member donciga confirmed "A is correct" and linked Cisco's replace-faulty-unit support document, while tinyJoe noted that "in any case the first thing to do is break the HA pair." This aligns with the FMC Devices > Device Management Break HA control.

Why the Other Options Are Wrong

Option B, registering the secondary device, fails because FMC still has the old HA relationship; registering a new secondary before breaking HA creates a management conflict. Option C, unregistering the secondary device, sounds logical but skips the mandatory break, so the active member remains in a stale HA state and the replacement cannot cleanly form a new pair. Option D, configuring NTP time synchronization, is a necessary prerequisite for HA formation and health later, but it does not separate the existing pair and is not the first action. The exam tests sequence, and Cisco's procedure puts the break before any unregister, register, or time-sync step.

Community Comment Notes

The two comments on this item both select A, and they point to authoritative Cisco documentation rather than opinion. tinyJoe explicitly reasons that regardless of which HA unit is being replaced, the first thing to do is break the HA pair. donciga adds a direct "A is correct" verdict and cites the Cisco support article for replacing a faulty unit in a Secure Firewall Threat Defense HA pair. That community consensus supports the vendor-documented first action and matches the answer key used here.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Remember the HA replacement sequence: break, unregister faulty, register replacement, re-establish HA. If a question asks for the first step, choose the break action before any registration or time-sync option.

Frequently Asked Questions

Why must I break the HA pair before unregistering the failed Secure Firewall device?

FMC treats the HA pair as one logical device; breaking HA first returns both units to standalone so the failed unit can be unregistered and the replacement can register cleanly.

Can I just configure NTP before breaking HA to restore high availability?

No. NTP synchronization is needed for the replacement to form HA later, but it is not the first action; the existing HA relationship must be broken in FMC before any registration steps.

More 300-710 FAQ →

Discussion 2 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 2

  1. tinyJoe 👍 4 Answered A
    I don't know which of the HAs to replace, but in any case the first thing to do is break the HA pair. https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/760/management-center-device-config-76/high-availability.html#id_14945
  2. donciga 👍 1 Answered A
    A is correct https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/221097-replace-faulty-unit-in-secure-firewall-t.html

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Changing FTD from Routed to Transparent Mode

S-grade

How Do You Isolate BVI Traffic on a Routed FTD?

S-grade

Cisco FTDv Licensing Model Valid Statements

S-grade

Duo and RTC for FTD Remote Access VPN

S-grade

← Back to 300-710 Study Guide