A. Routing table lookup
B. Unique interface MAC address
C. Unique interface IP address
D. MAC address table lookup
E. Unique global mapped IP addresses
Answer: B and E.
If multiple contexts share an interface, then the classifier uses the interface MAC address. The ASA lets you assign a different MAC address in each context to the same shared interface. By default, shared interfaces do not have unique MAC addresses; the interface uses the burned-in MAC address in every context. An upstream router cannot route directly to a context without unique MAC addresses. You can set the MAC addresses manually when you configure each interface or you can automatically generate MAC addresses.
If you do not have unique MAC addresses, then the classifier intercepts the packet and performs a destination IP address lookup. All other fields are ignored; only the destination IP address is used. To use the destination address for classification, the classifier must have knowledge about the subnets located behind each security context. The classifier relies on the NAT configuration to determine the subnets in each context. The classifier matches the destination IP address to either a static command or a global command. In the case of the global command, the classifier does not need a matching nat command or an active NAT session to classify the packet.
The Cisco ASA is configured in multiple mode and the security contexts share the same outside physical interface. What are the two classification methods used by the Cisco ASA to determine which security context to forward the incoming traffic? (Choose two.)