Cisco · Free Practice Questions · Last reviewed May 2026
24 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
An administrator configures an Identity Policy on the FMC to authenticate users via Active Directory using captive portal. Where is the Identity Policy applied within the Firepower configuration hierarchy?
Directly under Devices > Device Management > Platform Settings
Within the Access Control Policy settings on the FMC
Identity policies are bound to access control policies on the FMC; the ACP then applies them to matching traffic. The captive portal authentication and Active Directory realm selection therefore take effect only through that access control policy association, not at the device or platform level.
Inside the SSL/TLS Decryption Policy
As a standalone rule inside a Prefilter Policy
A network engineer needs to configure Auto NAT on a Firepower Threat Defense device managed by FMC to translate internal subnet 10.10.10.0/24 to a single public IP address 203.0.113.50. Which translation type should be selected?
Static NAT
Dynamic PAT (Port Address Translation)
Dynamic PAT translates many internal addresses to one public IP using unique source ports, matching the /24-to-single-address requirement. Static NAT would need one public address per host, and dynamic NAT without PAT requires a pool.
Static Identity NAT
Dynamic NAT
An administrator wants to create a Prefilter policy to fast-path (bypass Snort inspection for) a trusted backup stream between two data centers. Which action type should be selected in the Prefilter rule?
FastPath
FastPath bypasses Snort inspection entirely for matching traffic, satisfying the requirement to fast-path the trusted backup stream. Access Control rules instead block or allow with inspection, so FastPath is the only action that skips intrusion analysis while permitting the flow between data centres.
Monitor
Block
Inspect
Trust
An administrator is configuring a new Access Control Policy on the Firepower Management Center and needs to add a rule that blocks peer-to-peer file sharing applications regardless of port. Which rule type should the administrator select?
NAT rule
Identity rule
Access control rule
Access control rules match traffic by application identity, so peer-to-peer file-sharing applications are blocked regardless of the port they use. Port-based rules would fail here, since these applications evade fixed-port blocking by dynamically shifting ports.
Prefilter rule
An administrator wants to create a Port object group containing TCP ports 80, 443, and 8080 on the FMC. Where is this object configured?
Policies > Access Control > Ports
Devices > Device Management > Object Explorer
Objects > Object Management > Ports
Port object groups are created under Objects > Object Management > Ports in the FMC, where individual TCP and UDP ports are defined and grouped. This location satisfies the requirement to build a group containing TCP ports 80, 443 and 8080.
System > Configuration > Port Groups
An enterprise requires FTD to decrypt outbound SSL/TLS traffic so internal users visiting external websites can be inspected by Snort for malware. Which policy and action combination must be configured?
SSL/TLS Decryption Policy with Decrypt - Resign action
Outbound inspection requires the firewall to intercept the TLS session, so a Decrypt - Resign action re-signs traffic with an internal CA certificate, letting Snort inspect plaintext. Decrypt - Pass Through would leave traffic encrypted and invisible to Snort, failing the malware inspection requirement.
Prefilter Policy configured with SSL Bypass
SSL/TLS Decryption Policy with Decrypt - Inbound action
Access Control Policy with Malware Inspection enabled and no SSL policy
Want more Configuration practice?
Practice this domainAn administrator is troubleshooting a Stateful High Availability (HA) pair of Cisco Secure Firewall 4100 series devices managed by FMC. The units are failing to form an HA state, and logs indicate a state mismatch on the control link. Which underlying cause is most likely preventing the HA synchronization?
The MTU on the data interfaces differs by 4 bytes.
The stateful HA control link is configured across a routed switch interface instead of a direct cross-over cable.
The management IP addresses on the active and standby units are identical.
One unit is running a slightly different maintenance patch release of FTD than its peer.
Stateful failover requires identical software versions on both peers; a differing FTD maintenance patch causes the control-link state mismatch, blocking HA formation. Matching releases across the pair is a documented prerequisite for the HA state machine to synchronise.
An engineer is configuring static route tracking on a Cisco Secure Firewall Threat Defense to ensure high availability for outbound internet connectivity. A backup static route is configured with a higher metric. What mechanism does the firewall use to dynamically switch from the primary route to the backup route when the primary next-hop fails?
Bidirectional Forwarding Detection (BFD) or ICMP ping SLA trackers that monitor the next-hop IP.
Static route tracking relies on SLA monitor objects using ICMP echo or BFD to probe the primary next-hop. When probes fail, the tracked route is removed from the routing table, letting the higher-metric backup route become active and restoring outbound connectivity.
STP topology change notifications received on the tracked interface.
FMC heartbeat loss detection between the firewall and the gateway.
Automatic generation of dynamic OSPF neighbor adjacencies over the static interface.
You are deploying a Cisco Secure Firewall Threat Defense in an existing core network as an out-of-band intrusion prevention system. Which NGIPS deployment mode should you configure to ensure the firewall performs deep packet inspection and generates alerts without dropping any production traffic in the event of a device failure or high load?
Transparent mode with inline bypass enabled
Inline deployment mode with fail-open enabled
Routed mode with asymmetric routing tolerance
Passive deployment mode using a SPAN or tap source
Passive mode with a SPAN or tap source copies production traffic to the Threat Defense for deep packet inspection and alerting, while the inline path remains untouched. A device failure or overload therefore cannot drop production traffic, meeting the out-of-band constraint.
You are configuring an active/standby High Availability pair for Cisco Secure Firewall Threat Defense using FMC. You need to configure port channels for the data interfaces to increase bandwidth and redundancy. Which guideline must be followed regarding port channels in an HA deployment?
LACP active mode is unsupported on HA secondary units; static port channels must be used instead.
Port channels are restricted to transparent mode HA configurations only.
The port channel interfaces on both the primary and secondary units must have identical interface IDs and member port compositions.
For an active/standby failover to function, both units must present matching port channel configurations, so identical interface IDs and member port compositions ensure the standby can take over the data interfaces without link or aggregation mismatches.
Port channels can only be configured on the active unit; the standby unit automatically inherits them via stateful sync.
An enterprise network design incorporates Equal-Cost Multi-Path (ECMP) routing across two Cisco Secure Firewall Threat Defense units functioning independently in routed mode. What is the primary benefit of enabling ECMP on the firewalls?
It allows passive NGIPS interfaces to share inspection load without SPAN replication.
It pools the CPU and memory resources of both firewalls into a single logical cluster.
It enables the firewall to balance outbound traffic across multiple next-hop gateways using multiple equal-cost routes.
ECMP installs multiple equal-cost routes to the same destination, and the firewall hashes flows across those next-hop gateways. This balances outbound traffic over several paths, which is the primary benefit for independently routed Threat Defense units.
It synchronizes connection state tables across both independent firewalls for zero-loss failover.
An administrator is configuring a new Cisco Secure Firewall Threat Defense in routed mode on Firepower Device Manager (FDM). During the initial setup, the administrator needs to define the routing behavior for a multi-zone deployment. Which configuration step is mandatory when setting up routed mode?
Disable the Snort inspection engine on all interfaces to allow bridging.
Assign a unique Layer 3 IP address to each data interface and associate it with a security zone.
Routed mode requires each data interface to hold a unique Layer 3 IP address and belong to a security zone, because FDM forwards traffic between zones via routing decisions rather than Layer 2 bridging. Without this per-interface addressing and zone association, inter-zone policy enforcement and route lookup cannot function.
Assign a unique MAC address override to every physical interface.
Create a BVI (Bridge Virtual Interface) for each pair of physical interfaces.
Want more Deployment practice?
Practice this domainAn administrator needs to troubleshoot a routing issue on an FTD device managed by FMC. Where in the FMC GUI should the administrator navigate to view and modify static and dynamic routing configurations for the device?
Objects > Object Management > Network > Routes
Devices > Device Management > Edit Device > Routing tab
Static and dynamic routing for a managed FTD is configured under Devices > Device Management, editing the device and opening the Routing tab, which exposes virtual routers, static routes and dynamic routing protocols. This satisfies the requirement to view and modify routing configuration in the FMC GUI.
System > Configuration > Network Settings
Policies > Access Control > Routing
An FTD device is dropping packets unexpectedly. An engineer runs a packet tracer via the FTD diagnostic CLI using 'system support diagnostic-cli' and enters the command: 'packet-tracer input inside tcp 192.168.1.50 12345 10.0.0.5 80'. The output shows a drop at the 'Access-Rule' phase with the action 'DROP'. What does this indicate?
The NAT translation table lacks a dynamic PAT port allocation for the source IP.
An Access Control Policy rule matched the connection parameters and was configured with an action of Block or Block with reset.
The packet-tracer output shows the connection was evaluated against the Access Control policy and matched a rule whose action blocks it. The Access-Rule phase drop therefore indicates an explicit Block or Block with reset action, not a default or prefilter drop.
The FTD routing table does not have a valid route back to the source IP 192.168.1.50.
The SSL decryption policy failed to validate the server certificate for 10.0.0.5.
During a routine backup of the FMC, the administrator wants to ensure that the generated backup file contains critical historical events, configurations, and intrusion event data so that it can be fully restored to a replacement appliance if necessary. Which backup type should be selected in the FMC?
Manual Backup with both System Settings and Historical Event Data checkboxes enabled
Selecting Manual Backup with both System Settings and Historical Event Data captures configurations plus historical events and intrusion data, satisfying the requirement for a fully restorable replacement appliance. The Historical Event Data checkbox is the specific element that includes event records; System Settings alone would omit them.
RAID Controller Configuration Export
System Configuration Backup only
Snort Rule Update (SRU) Snapshot Backup
An engineer needs to analyze the connection history and security events from an FTD device that occurred three weeks ago. However, when querying the FMC event viewer, the events are missing. What is the most likely cause of this behavior?
The administrator must run 'database-cli optimize' on the FTD CLI to unhide historical events.
The FTD automatically flushes its local event buffer every 48 hours regardless of FMC configuration.
Security events older than 7 days are automatically archived to the Cisco Cloud Analytics platform by default.
The events were overwritten because the event database retention period or disk space limit was reached.
The FMC event database has a finite retention period and disk allocation; once either limit is reached, older events are purged. Three-week-old FTD connection and security events were therefore overwritten, explaining their absence from the event viewer.
An administrator wants to configure automated email notifications from the FMC whenever a critical health monitor alert occurs on any managed device. Where should this be configured in the FMC GUI?
Objects > Object Management > Alerting
Policies > Access Control > Logging
System > Health > Monitor > Alert Responses
System > Health > Monitor > Alert Responses defines automated actions triggered by health monitor alerts, including email notifications. Configuring the response here satisfies the requirement for automatic emails whenever a critical health alert fires on any managed device.
Devices > Device Management > Alerts
An administrator needs to verify the license status and active feature subscriptions (such as URL Filtering, Malware, and IPS) on an FMC. Where should the administrator check this information in the FMC GUI?
Policies > Access Control > Subscriptions
System > Licenses > Smart Licenses
System > Licenses > Smart Licenses displays the FMC's registration status and the active feature subscriptions, including URL Filtering, Malware and IPS. This is the single GUI location where an administrator verifies which entitlements are currently enabled and consumed.
Objects > Object Management > Licensing
Devices > Device Management > Licenses
Want more Management And Troubleshooting practice?
Practice this domainAn administrator wants to stream security events, connection events, and intrusion events from Cisco Secure Firewall Management Center (FMC) to a third-party SIEM platform. Which built-in protocol and feature on the FMC should be configured to export these events in real-time?
pxGrid
NETCONF
eStreamer
eStreamer is FMC's native event-streaming API, delivering security, connection and intrusion events to third-party SIEM clients in real time over a persistent TLS connection. It satisfies the stem's requirement for a built-in FMC protocol exporting these event types, unlike syslog, which lacks structured intrusion event fields.
RADIUS Accounting
An administrator is integrating Cisco Secure Firewall Threat Defense with Cisco Identity Services Engine (ISE) using Platform Exchange Services (pxGrid). Which service must be enabled and running on the ISE nodes for pxGrid communication to succeed?
IPAM Synchronization Service
RADIUS Accounting Service
Cisco pxGrid Service
The Cisco pxGrid Service on ISE provides the publish-subscribe framework that FMC uses to receive session, identity and endpoint context. Enabling it on the ISE nodes lets the FTD subscribe to identity topics, satisfying the pxGrid communication requirement in the stem.
TACACS+ Authentication Service
Which menu path in the Cisco Secure Firewall Management Center (FMC) is used to configure the connection to Cisco Threat Response or Cisco SecureX?
System > Integration > SecureX
System > Integration > SecureX is the correct path because FMC centralises cloud-service connectors under System > Integration, where the SecureX/Threat Response client registration, Cisco SecureX sign-on and device enrolment are configured. This satisfies the stem's requirement for the menu used to establish the Cisco SecureX or Threat Response connection.
Devices > Device Management > Threat Intelligence
Objects > Object Management > Cloud Services
Policies > Access Control > Security Intelligence
An enterprise integrates Cisco Secure Firewall Management Center with Cisco ISE using pxGrid for identity-based access control. The security team notices that user identity mapping works for domain users authenticating via 802.1X, but guest users connecting through a WebAuth portal do not have their user-to-IP mappings populated on the FTD. What is the root cause of this issue?
FMC requires an active eStreamer connection to ingest guest identities because pxGrid only supports Active Directory domain accounts.
Guest users must manually log into a captive portal hosted on the FTD data plane before ISE can share their identity.
The FTD identity policy must be configured with a RADIUS server group instead of pxGrid to support guest VLANs.
The pxGrid connection on ISE is not subscribed to the guest session topic, or guest session publishing is disabled in ISE deployment settings.
pxGrid delivers identity mappings only for topics the FMC subscribes to. Guest WebAuth sessions publish on a separate guest session topic; without that subscription or with guest publishing disabled in ISE, guest user-to-IP mappings never reach FTD.
An administrator is configuring third-party SIEM integration using eStreamer. The external client application encounters a TLS handshake failure when attempting to connect to the FMC eStreamer port. What is the standard troubleshooting step to resolve certificate validation issues between an external eStreamer client and the FMC?
Disable SSL/TLS verification in the FMC Platform Settings under the eStreamer daemon parameters.
Restart the Snort inspection engine on all managed FTD devices.
Generate a new pkcs12 client certificate bundle from the FMC eStreamer configuration menu and import it into the client application store.
The eStreamer client must present a certificate the FMC trusts. Regenerating the pkcs12 bundle from the FMC eStreamer configuration menu and importing it into the client's certificate store restores mutual TLS validation, resolving the handshake failure caused by a mismatched or expired client certificate.
Change the eStreamer listening port from 8302 to 443 in the FMC System Preferences.
When configuring Cisco Secure Firewall Threat Defense to forward syslog messages to a remote SIEM receiver, which transport layer protocols are natively supported for syslog export?
HTTP and HTTPS only
UDP only
UDP and TCP
UDP and TCP are both natively supported for syslog export from Cisco Secure Firewall Threat Defense, satisfying the stem's requirement for transport layer protocols. UDP provides connectionless, fire-and-forget delivery, while TCP adds reliable, connection-oriented transmission with acknowledgement, letting you choose based on SIEM reliability needs.
TCP and SCTP
Want more Integration practice?
Practice this domainThe vendor does not publish an exact question count for the 300-710 SNCF; the exam lasts 90 minutes. Always confirm current details on the vendor's official exam page.
CLI output interpretation, network topology analysis, routing behaviour, switching concepts, troubleshooting, and configuration questions.
The exam covers 4 domains: Configuration, Deployment, Management And Troubleshooting, Integration. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Cisco 300-710 SNCF exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.