Duo and RTC for FTD Remote Access VPN

300-710 By islever Editorial Last updated Oct 4, 2026

Describe Rapid Threat Containment (RTC) functionality within Secure Firewall Management Center Configure security policies such as access control, DNS, identity, and network analysis policy in Secure Firewall Management Center

Short answer

AE Cisco FTD remote access VPN supports Duo two-factor authentication using LDAPS and Rapid Threat Containment using RADIUS dynamic authorization.

Question

Which two features can be used with Cisco Secure Firewall Threat Defense remote access VPN? (Choose two.)

enable Duo two-factor authentication using LDAPS Correct Answer
support for Cisco Secure Firewall 4100 Series in cluster mode
SSL remote access VPN supports port sharing with other Cisco FTD features using SSL port 443
use of license utilization for zero-touch network deployment
support for Rapid Threat Containment using RADIUS dynamic authorization Correct Answer

Key Takeaways

The question tests supported features for FTD remote access VPN, specifically Duo 2FA with LDAPS and RTC with RADIUS CoA, with the common trap being port sharing on 443.

Cisco Secure Firewall Threat Defense remote access VPN supports Duo two-factor authentication via LDAPS and Rapid Threat Containment (RTC) via RADIUS dynamic authorization. This page establishes why options A and E are the correct features and why port sharing is invalid.

Common mistake: Choosing C because SSL VPN typically uses port 443, but FTD requires exclusive use of this port and does not support port sharing for RA VPN.

Expert Analysis

Why the Answer Is Correct

Cisco Secure Firewall Threat Defense (FTD) remote access VPN supports Duo two-factor authentication using LDAPS, allowing integration with Duo's cloud service for secondary authentication. Additionally, FTD RA VPN supports Rapid Threat Containment (RTC) using RADIUS dynamic authorization (Change of Authorization), enabling the firewall to dynamically restrict or terminate user sessions based on threat postures. These two features are explicitly documented as supported for FTD remote access VPN configurations.

Why the Other Options Are Wrong

Option B is incorrect because FTD remote access VPN does not support high availability clustering on the 4100 Series. Option C is a major trap; FTD explicitly prohibits port sharing on SSL port 443 with other features, requiring the port to be exclusively dedicated to the VPN. Option D is incorrect as license utilization for zero-touch network deployment is not a feature of remote access VPN.

Community Comment Notes

Community members strongly agree that A and E are correct. As tinyJoe noted, "C is clearly wrong from the following documentation" which states "These ports must not be used on the threat defense device before configuring remote access VPN policy". artilling also confirmed "Rapid Threat Containment support using RADIUS CoA or RADIUS dynamic authorization" for option E, while acknowledging Duo LDAPS support despite its end-of-life status for direct cloud connections.

Official Reference

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/760/management-center-device-config-76/vpn-remote-access.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

For FTD remote access VPN questions, remember that SSL port 443 cannot be shared with other features and must be dedicated. Also, recall that RTC relies specifically on RADIUS dynamic authorization (CoA) to function with VPN sessions.

Community Votes

67%

33%

67% of anonymous learners picked answer AE. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors, not of islever. The comments shown first are the most substantive of the thread — ranked by depth, community endorsement and relevance; expand the list below to read the rest.

From public community threads 6

LC1980 👍 7

Correct answer is A and E. https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/710/management-center-device-config-71/vpn-remote-access.html
artilling 👍 3

A. Now LDAPS with Cisco Duo went to End Of Live. But until February 20, 2025 this bundle worked. "VPN users logging into existing LDAPS applications can still complete two-factor authentication. Duo Support teams will continue to troubleshoot LDAPS applications." https://help.duo.com/s/article/8019?language=en_US E. Rapid Threat Containment support using RADIUS CoA or RADIUS dynamic authorization. https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/710/management-center-device-config-71/vpn-remote-access.html#concept_kkw_sv2_2hb
tinyJoe 👍 3

Definitely A and E. C is clearly wrong from the following documentation: https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/760/management-center-device-config-76/vpn-remote-access.html?bookSearch=true#:~:text=These%20ports%20must%20not%20be%20used%20on%20the%20threat%20defense%20device%20before%20configuring%20remote%20access%20VPN%20policy
aaInman 👍 3

A and C - Cisco is never going to miss an opportunity to sell another one of their services in its certification exam. Configure DUO for LDAP over VPN https://duo.com/docs/ciscoasa-ldap#:~:text=Duo%20Two%2DFactor%20Authentication%20with%20LDAPS%20for%20Cisco%20ASA%20SSL%20VPN%20with%20Browser%20and%C2%A0AnyConnect
LC1980 👍 2

Cer2020, what you say is correct but there aren't other correct choises in the answer, so I prefer A

Show 1 more comment

Cer2020 👍 1

Can't be A - You cannot use a direct connection with the Duo Cloud Service over LDAPS - need an Auth Proxy

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

← Back to 300-710 Study Guide