300-710 SNCF Practice Test 12 — 15 Questions

Question 1

When deploying a Cisco Secure Firewall Threat Defense in transparent mode, how are the firewall interfaces configured to pass traffic between segments without routing?

Accepted Answer

Interfaces are grouped into a Bridge Virtual Interface (BVI) bridge group that acts as a Layer 2 bridge.. In transparent mode, the firewall bridges traffic between interfaces using a Bridge Virtual Interface (BVI). The BVI is assigned an IP address for management and Layer 3 functions, while the physical interfaces belong to the bridge group.

Answer

Interfaces are configured with dynamic NAT overload to translate Layer 2 MAC addresses into Layer 3 IPs.

Answer

The firewall acts as an 802.1Q trunk port where all VLANs are terminated on a single subinterface.

Answer

Each physical interface is assigned a distinct IP address in the same subnet.

Question 2

Which THREE of the following are necessary to configure an FTD in passive mode?

Accepted Answer

Disable the interface IP address.. Passive mode requires an interface to be in a non-routing mode, typically using a SPAN port, and it does not allow for blocking traffic.

Answer

Assign a static route to the passive interface.

Answer

Enable hardware bypass.

Question 3

An engineer needs to deploy a Cisco Secure Firewall Threat Defense in transparent firewall mode. Which TWO statements describe characteristics of transparent mode? (Choose two)

Accepted Answer

The firewall operates as a Layer 2 bridge, forwarding frames based on destination MAC addresses.. Transparent mode bridges traffic across interfaces in a bridge group using BVIs, acting as a stealth firewall at Layer 2.

Answer

Every interface in transparent mode must have a unique Layer 3 subnet IP address for routing.

Answer

NAT is fully unsupported across all transparent firewall deployments.

Answer

Dynamic routing protocols like OSPF and EIGRP are fully supported on BVI interfaces.

Question 4

An administrator is managing high availability failover events for Cisco Secure Firewall Threat Defense devices using Cisco FMC. Which TWO actions or events will trigger a failover from the active unit to the standby unit? (Choose two)

Accepted Answer

Failure of a monitored data interface exceeding the configured interface failure criteria.. Failover is triggered by events such as hardware failure, loss of heartbeat on the failover/control link, or interface failure thresholds being exceeded.

Answer

An administrator logging into the FMC user interface via HTTPS.

Answer

An increase in CPU utilization above 10% on the active unit.

Answer

A scheduled backup job running on the secondary unit.

Question 5

You are deploying an FTD in AWS. What is the correct way to handle the internal IP addresses of the FTD instances in an HA pair?

Accepted Answer

Use a virtual IP via API calls to the VPC route table.. In AWS, you assign virtual secondary IPs or use Elastic IPs to ensure that traffic is routed correctly even after a failover event.

Answer

Configure VRRP on the interfaces.

Answer

Use physical interface MAC pinning.

Answer

Configure a cluster control link.

Question 6

Which THREE features are critical for maintaining a stable FTD cluster?

Accepted Answer

Synchronized FMC management.. Clustering requires a dedicated control link for health, a data port channel for traffic, and consistent configuration via the FMC.

Answer

Individual IP addresses for every member on every network.

Answer

External load balancer for traffic scrubbing.

Question 7

An enterprise network architect is designing high availability for Cisco Secure Firewall Threat Defense using static route tracking and IP SLA. Which THREE components are essential for implementing robust static route tracking? (Choose three)

Accepted Answer

An IP SLA monitor or BFD session configured to periodically ping or probe the target next-hop IP address.. Static route tracking requires an IP SLA probe (or BFD), a tracking object that evaluates the probe status, and a static route tied to that tracking object.

Answer

A BGP peer group session terminating on the firewall management interface.

Answer

An active cluster control link across three physical security modules.

Question 8

An administrator is preparing to deploy Cisco Secure Firewall Threat Defense in passive NGIPS mode connected to a Catalyst switch. Which TWO configuration steps on the switch and firewall are necessary for successful packet inspection? (Choose two)

Accepted Answer

Configure the firewall data interfaces to operate in passive mode so they do not attempt to forward or drop traffic.. Passive mode requires configuring a SPAN session (or TAP) on the switch to mirror traffic and configuring passive interfaces on the FTD to ingest and inspect that mirrored stream.

Answer

Enable dynamic OSPF routing between the switch and the firewall's passive interface.

Answer

Assign a default gateway IP address to the passive interface to route return packets back to clients.

Answer

Configure an inline set pairing the passive interfaces with a hardware bypass module.

Question 9

A network security engineer is setting up a high availability (HA) pair for two Cisco Secure Firewall Threat Defense devices managed by Cisco FMC. Which prerequisite condition must be met between the primary and secondary units before configuring the HA pair?

Accepted Answer

Both units must have different management IP addresses assigned to their respective management interfaces.. Before configuring an HA pair, both units must have the same exact model, identical license configurations, the same software version, and identical interface configurations/naming.

Answer

The primary unit must be configured in routed mode while the secondary unit is in transparent mode.

Answer

The secondary unit must be running a newer software version than the primary unit to support failover synchronization.

Answer

The data interfaces must use dynamic DHCP addressing to ensure seamless failover state transfer.

Question 10

An engineer is preparing to deploy a Cisco Secure Firewall Threat Defense cluster in an enterprise data center. Which THREE requirements must be verified and configured prior to cluster initialization? (Choose three)

Accepted Answer

A dedicated high-speed, low-latency Cluster Control Link (CCL) must be connected between all nodes.. Firewall clustering requirements include identical hardware models/licenses, dedicated Cluster Control Link (CCL) connections, and Port Channels connecting upstream/downstream switches to all cluster nodes.

Answer

The cluster master must be configured in transparent mode while slave nodes operate in routed mode.

Answer

Each cluster member must run a different software version to prevent simultaneous kernel panics.

Question 11

A security engineer is deploying a Cisco Secure Firewall Threat Defense device inline in front of a critical server farm. The goal is to inspect all incoming and outgoing traffic for intrusions without modifying the IP addressing schema of the servers. Which interface mode should be configured on the FTD device?

Accepted Answer

Inline mode with a bypass capability. Inline mode places the firewall directly in the path of traffic, allowing it to inspect, drop, or modify packets while operating transparently or via routed configurations.

Answer

Passive mode

Answer

SPAN mode

Answer

Promiscuous mode

Question 12

Which THREE of the following are valid requirements or characteristics when deploying Cisco Secure Firewall Threat Defense in a high availability (HA) configuration? (Choose three)

Accepted Answer

Both units must run the exact same software version and maintenance patch level.. FTD High Availability requires identical hardware/virtual models, the same software versions, and dedicated HA links.

Answer

Transparent mode HA supports asymmetric routing paths across both active and standby units simultaneously.

Answer

The active and standby units can have differing amounts of RAM as long as the CPU core counts match.

Question 13

An administrator is troubleshooting a Cisco Secure Firewall Threat Defense high availability deployment where MAC address persistence is causing intermittent packet drops after a failover event. What is the role of MAC address persistence in an HA setup?

Accepted Answer

It ensures that the active unit retains the virtual MAC addresses of the interfaces, preventing the need for downstream switches to relearn MAC-to-port mappings.. MAC persistence ensures that the active firewall unit takes over the virtual MAC addresses of the HA pair, ensuring downstream switches immediately update their MAC forwarding tables without waiting for aging timers.

Answer

It encrypts the MAC header of all packets crossing the stateful failover control link.

Answer

It forces downstream Layer 2 switches to continuously flood broadcast traffic to both firewall nodes simultaneously.

Answer

It locks the management IP address to a static MAC address to prevent ARP spoofing attacks.

Question 14

An administrator is configuring a static route tracking mechanism on a Cisco Secure Firewall Threat Defense device using an ICMP Echo IP SLA object. What happens to the tracked static route if the SLA probe fails to receive a response?

Accepted Answer

The static route is removed from the routing table, allowing alternative routes to become active.. When an IP SLA probe fails, the tracked object changes its state to DOWN, causing the dependent static route to be removed from the routing table, allowing backup routes to take over.

Answer

The static route metric is automatically incremented by 100 while remaining active.

Answer

The firewall automatically reboots into maintenance mode to clear the routing cache.

Answer

All firewall interfaces are automatically placed in an administrative shutdown state.

Question 15

An administrator is configuring static route tracking on a Cisco Secure Firewall Threat Defense device managed by FMC. A tracked IP address becomes unreachable, and the primary static route is removed from the routing table. What mechanism does FTD use to verify the reachability of the tracked destination?

Accepted Answer

ICMP Echo or TCP Connect probes managed by IP SLA tracking objects. Static route tracking in FTD uses IP SLA monitoring (ICMP Echo or TCP probes) to continuously test reachability and trigger failover to a backup route.

Answer

ARP request polling sent every 3 seconds to the default gateway MAC address

Answer

Continuous bidirectional forwarding detection (BFD) sessions initiated directly from the routing daemon process

Answer

SNMP trap polling managed by the Firepower Management Center correlation engine