300-710 SNCF Practice Test 12 — 15 Questions

Question 1

An administrator is configuring third-party SIEM integration using eStreamer on the FMC. A custom client application is written to connect to the FMC eStreamer server, but the connection is immediately reset. What is the most likely cause of this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The eStreamer client certificate and pkcs12 password have not been generated and configured on the FMC.. Before an eStreamer client can connect to FMC, an eStreamer certificate and password must be generated on the FMC and imported into the client application.

Answer

The SIEM is using TCP port 443 instead of eStreamer default port 8305.

Answer

Syslog facility levels are set to local0 instead of daemon.

Answer

pxGrid service is disabled on the FMC.

Question 2

You have a large number of NAT rules. How does the FTD process them?

Accepted Answer

Top-down. NAT rules are processed in a top-down order until the first match is found.

Answer

Bottom-up

Answer

Specific to General

Answer

Alphabetical

Question 3

An administrator is setting up health monitoring alerts on the FMC. Which TWO notification methods can be configured when a health alert is triggered? (Choose two)

Accepted Answer

Email notification. On the Cisco Firepower Management Center (FMC), health monitoring alerts can be delivered through the built-in notification mechanisms, and the two supported methods are Email notification (B) and SNMP Trap (C). Email notification (B) is correct because FMC's health monitor configuration allows you to specify recipient email addresses and an SMTP server so that alert messages are sent when a health event occurs. SNMP Trap (C) is correct because FMC can be configured with SNMP trap receivers, allowing health alerts to be forwarded as SNMP traps to a monitoring station. The remaining options are not valid FMC health alert delivery methods: FMC has no built-in cellular SIM for SMS (A), no Bluetooth broadcast capability for alerts (D), and no SIP trunking integration to place automated phone calls (E).

Answer

Automated SMS text message directly via built-in cellular SIM

Answer

Direct Bluetooth broadcast

Answer

Automated phone call via SIP trunking

Question 4

An engineer is troubleshooting a passive NGIPS deployment where the Cisco Secure Firewall is connected to a switch SPAN port. Security analysts report that certain VLAN-tagged packets are not appearing in the event logs. What is the most likely cause?

Accepted Answer

The passive interface or subinterfaces on the firewall are not configured to recognize or decode the specific 802.1Q VLAN tags present in the SPAN stream.. In a passive NGIPS deployment fed by a switch SPAN port, the firewall's passive interface must be able to parse the frames it receives. If the SPAN source is a trunk carrying 802.1Q-tagged frames, the passive interface (or its subinterfaces) must be configured to recognize those VLAN tags; otherwise the Snort engine cannot correctly decode the packets and they never generate events. This is a classic SPAN/trunk mismatch issue in Firepower troubleshooting.

Answer

The firewall management IP address is misconfigured, causing packet loss on the monitoring port.

Answer

The Snort inspection engine drops all SPAN traffic by default unless inline bypass mode is active.

Answer

Passive interfaces do not support VLAN tagging; all trunk traffic must be untagged at the switch SPAN source.

Question 5

An engineer is deploying a Cisco Secure Firewall Threat Defense Virtual (FTDv) instance in an Amazon Web Services (AWS) VPC. The deployment requires the FTDv to inspect traffic crossing between public and private subnets. Which AWS architectural construct is mandatory for routing traffic through the FTDv instance?

Accepted Answer

Custom AWS Route Tables associated with the subnets, pointing traffic destined outside the VPC to the FTDv data interface ENI.. In AWS, traffic is routed between subnets and to the internet based on Route Tables associated with each subnet. To force traffic through an FTDv instance, you must create custom Route Tables whose default route (0.0.0.0/0) or specific destination prefixes point to the FTDv's data interface ENI, and associate those route tables with the public and private subnets. This is the standard AWS 'firewall appliance' architecture and is mandatory for inline inspection.

Answer

Cisco TrustSec Security Group Tags (SGTs) applied to AWS security groups.

Answer

AWS Transit Gateway with static BGP peering enabled to the FTDv management interface.

Answer

Physical bypass NICs installed in the AWS hypervisor layer.

Question 6

An engineer is configuring static route tracking on a Cisco Secure Firewall Threat Defense to ensure high availability for outbound internet connectivity. A backup static route is configured with a higher metric. What mechanism does the firewall use to dynamically switch from the primary route to the backup route when the primary next-hop fails?

Accepted Answer

Bidirectional Forwarding Detection (BFD) or ICMP ping SLA trackers that monitor the next-hop IP.. Static route tracking on Cisco Secure Firewall Threat Defense uses SLA monitors — either BFD or ICMP ping — to track the reachability of the next-hop IP. When the tracked object goes down, the primary static route is removed from the routing table and the backup route with the higher metric is installed, providing dynamic failover.

Answer

STP topology change notifications received on the tracked interface.

Answer

FMC heartbeat loss detection between the firewall and the gateway.

Answer

Automatic generation of dynamic OSPF neighbor adjacencies over the static interface.

Question 7

What must be done to apply a change made in the Access Control Policy?

Accepted Answer

Click 'Deploy'. You must click 'Deploy' in the FMC to push the changes to the FTD.

Answer

Wait 24 hours

Answer

Click 'Save'

Answer

Restart the device

Question 8

You are creating a custom URL category. How do you add specific domains to this category in FMC?

Accepted Answer

Via Objects > Object Management > URL. Custom URL objects are created in the Object Manager and then assigned to the category.

Answer

In the SSL Policy

Answer

Directly in the Access Control rule

Answer

In the Prefilter Policy

Question 9

An administrator is troubleshooting an eStreamer connection between the FMC and a custom Python SIEM script. The connection is established, but no intrusion events appear in the SIEM. Which TWO potential reasons could explain why intrusion events are missing from the stream? (Choose two)

Accepted Answer

The Access Control policy applied to the FTD devices does not have an Intrusion Policy assigned to inspect and generate events.. Option C is correct because eStreamer only streams intrusion events that the FTD actually generates; if the Access Control policy has no Intrusion Policy assigned to the relevant rules, no intrusion inspection occurs and therefore no intrusion events exist to send to the SIEM. Option D is correct because eStreamer clients must explicitly request the event types they want during the initial handshake (the request message specifies flags for intrusion events, connection events, etc.); if the Python script omits the intrusion event record type in its subscription request, the FMC will not stream those events even though the connection is up. Option A is not correct because eStreamer uses a proprietary TCP-based protocol on port 8302, and a UDP mismatch would prevent the connection from establishing at all, not merely suppress intrusion events. Option B is not correct because changing the listening port would also break the connection unless the client is reconfigured to match, and the scenario states the connection is established. Option E is not correct because blocking the FTD management interface IP would disrupt management connectivity, not the FMC-to-SIEM eStreamer event stream, and Access Control rules do not govern eStreamer traffic.

Answer

The SIEM script is using UDP instead of TCP for eStreamer communication.

Answer

The FMC eStreamer listening port was changed from 8302 to 443.

Answer

The FTD management interface IP address is blocked by an Access Control rule.

Question 10

An administrator configures an Identity Policy on the FMC to authenticate users via Active Directory using captive portal. Where is the Identity Policy applied within the Firepower configuration hierarchy?

Accepted Answer

Within the Access Control Policy settings on the FMC. In FMC, Identity Policies are not standalone objects; they are referenced inside an Access Control Policy. The Access Control Policy contains the identity policy selection, and the identity policy defines the captive portal, AD realm, and authentication rules. This is why the correct placement is within the Access Control Policy settings on the FMC.

Answer

Directly under Devices > Device Management > Platform Settings

Answer

Inside the SSL/TLS Decryption Policy

Answer

As a standalone rule inside a Prefilter Policy

Question 11

An administrator is configuring an Identity Policy to enforce user-based access control. Which THREE identity sources are supported by the FMC for user awareness? (Choose three)

Accepted Answer

RADIUS Server (Authentication and Accounting). Option A (RADIUS Server with Authentication and Accounting) is correct because FMC can consume RADIUS accounting records (via the RADIUS Accounting Start/Stop messages) to map IP addresses to usernames for user awareness, and it can also use RADIUS authentication events as an identity source. Option B (Captive Portal for active web authentication) is correct because FMC supports an active authentication identity source where users are redirected to a captive portal and must log in, after which their IP-to-user mapping is learned for the duration of the session. Option D (Active Directory via AD Agent or Cisco ISE Passive Authentication) is correct because FMC integrates with Active Directory through the Cisco AD Agent (or directly via ISE) and with Cisco ISE using passive authentication (pxGrid/MnT) to receive user-to-IP mappings without user interaction. Option C is not a supported FMC user awareness identity source because FMC does not scrape arbitrary syslog servers for user identity without an agent or supported integration. Option E is not supported because SNMP MIB walks retrieve device and interface statistics, not user identity information, and FMC has no local SNMP MIB-walk identity source.

Answer

Syslog server log scraping without agent integration

Answer

Local SNMP MIB walk queries

Question 12

Which THREE methods can be used to populate IP address objects or groups in the FMC Object Management? (Choose three)

Accepted Answer

CIDR Network subnet. In Cisco FMC Object Management, IP address objects can be populated by entering a CIDR Network subnet (option B), such as 192.168.1.0/24, which defines a network block by prefix length. Option C, an Individual Host IP address, is also valid because FMC allows creating a host object with a single IPv4 or IPv6 address (for example, 10.10.10.10). Option D, an IP Address Range (start to end), is supported as well, letting you specify a contiguous range such as 192.168.1.10–192.168.1.20. The unmarked options do not belong: an Intrusion Signature ID number (option A) is used for intrusion policy/signature identification, not for defining IP address objects, and a MAC Address OUI prefix (option E) identifies a hardware vendor prefix, not an IP address or subnet.

Answer

Intrusion Signature ID number

Answer

Mac Address OUI prefix

Question 13

An engineer is deploying an NGIPS inline set across two physical interfaces. To prevent network disruption during maintenance, the engineer needs to ensure that if the firewall loses power or experiences a kernel panic, traffic can still traverse the physical link. Which hardware feature must the interfaces support?

Accepted Answer

Hardware bypass capability (fail-open). Optical or copper bypass capability (hardware fail-open/fail-close bypass caps) allows traffic to pass physically through the ports when power is lost or the system crashes.

Answer

Unidirectional Link Detection (UDLD)

Answer

Spanning Tree PortFast BPDU filtering

Answer

Dynamic ARP Inspection (DAI)

Question 14

Which TWO actions must be performed on Cisco ISE when setting up pxGrid integration with Cisco Secure Firewall Management Center (FMC)? (Choose two.)

Accepted Answer

Approve the certificate for the FMC client within the Cisco ISE pxGrid services administration interface.. Option B is correct because pxGrid uses mutual certificate-based authentication, so after the FMC registers as a pxGrid client, its client certificate must be approved in the ISE pxGrid Services administration interface before the FMC can subscribe to or publish pxGrid topics. Option E is correct because the pxGrid persona/service must be explicitly enabled on the ISE nodes (Policy Service Nodes or the Administration node) that will participate in the integration; otherwise the pxGrid controller and pub/sub services are not active and FMC cannot connect. Options A, C, and D are not required: pxGrid does not rely on TrustSec SGT propagation via NetFlow v9, SNMPv3 traps are not used to forward user-IP mappings to FMC, and RADIUS shared secrets belong to RADIUS authentication (e.g., for user or device authentication) rather than to the pxGrid integration itself.

Answer

Enable TrustSec SGT propagation via NetFlow v9 on all ISE interfaces.

Answer

Configure SNMPv3 traps on ISE to forward user IP mappings to the FMC.

Answer

Configure a RADIUS shared secret on the FMC platform settings page.

Question 15

Which TWO methods can be used to gather diagnostic information for a Cisco TAC case from an FTD device?

Accepted Answer

Generate a troubleshooting file in the FMC. Option A is correct because the Firepower Management Center (FMC) provides a built-in 'Generate Troubleshooting File' feature under the device's Troubleshoot menu, which bundles logs, configuration, and health data into a single archive specifically intended for Cisco TAC analysis. Option E is correct because running a packet capture on the FTD CLI (e.g., using the 'capture-traffic' command or the FTD 'capture' command in expert mode) lets an administrator collect live packet-level data that TAC commonly requests to diagnose traffic and inspection issues. Option B is not a standard TAC diagnostic method for FTD; a Snort memory dump is not a routine, supported data-gathering procedure and is typically used only for specific crash analysis. Option C is wrong because re-imaging the device is a destructive recovery action, not a diagnostic data-gathering method, and would erase evidence. Option D is wrong because exporting a full database schema is not a supported FTD diagnostic collection method and provides no useful troubleshooting data for TAC.

Answer

Taking a memory dump of the Snort process

Answer

Running a full system re-image

Answer

Exporting the full database schema