300-710 SNCF Practice Test 13 — 15 Questions

Question 1

An administrator is configuring an SSL Decryption Policy on the FMC. Which TWO conditions or actions can be configured within an SSL rule? (Choose two)

Accepted Answer

Matching traffic based on URL Categories (e.g., Banking, Gambling). Option A is correct because SSL rules on the FMC can match traffic using URL Category conditions (such as Banking or Gambling), which are evaluated against the URL/certificate information available before or during decryption. Option B is correct because 'Decrypt - Resign' is one of the standard SSL rule actions, in which the firewall acts as a man-in-the-middle, re-signing the server certificate with its own internal CA so the traffic can be inspected. Option C is incorrect because static route metrics are configured in the routing table (virtual router), not within an SSL decryption rule. Option D is incorrect because QoS rate limiting is handled by QoS policies, not SSL rules. Option E is incorrect because Snort 3 intrusion signatures are enforced through intrusion policies that are invoked as part of access control, not directly inside the SSL policy itself.

Answer

Configuring static route metrics for decrypted packets

Answer

Defining QoS rate limits for HTTPS sessions

Answer

Enforcing Snort 3 Intrusion rule signatures directly inside the SSL policy

Question 2

An engineer is deploying Cisco Secure Firewall Threat Defense in a complex multi-zone routed environment. Which THREE design considerations apply when implementing routed mode interfaces? (Choose three)

Accepted Answer

Each routed interface must belong to a distinct IP subnet and act as a Layer 3 gateway for connected segments.. Option B is correct because in routed mode each interface is a Layer 3 hop that must be assigned an IP address on a unique subnet, and it serves as the default gateway for hosts on that connected segment. Option D is correct because a routed-mode firewall terminates the Layer 2 domain on each interface, so it rewrites the source and destination MAC addresses of forwarded frames to its own egress interface MAC while preserving the IP packet. Option E is correct because routed interfaces support dynamic routing protocols such as OSPF, EIGRP, RIP, and BGP, allowing the Threat Defense to participate in the routed topology and advertise or learn routes. Option A is wrong because NAT is fully supported and commonly configured on routed interfaces for address translation and PAT. Option C is wrong because a BVI is used in transparent mode to group interfaces into a bridge, not in routed mode where each interface is its own Layer 3 subnet.

Answer

NAT configuration is strictly prohibited on routed mode interfaces.

Answer

All physical interfaces must be combined into a single Bridge Virtual Interface (BVI).

Question 3

An Identity Policy is configured on the FMC to authenticate users connecting through the FTD. The administrator wants to use Active Directory as the identity source. Which mechanism must be configured to map user IP addresses to usernames without requiring explicit web authentication?

Accepted Answer

Passive Authentication via AD Agent or ISE. Passive authentication utilizes the Cisco User Agent or Firepower Identity Services Engine (ISE) / AD agent to map IP addresses to usernames transparently.

Answer

Captive Portal

Answer

Local User Database

Answer

RADIUS Server Authentication

Question 4

When configuring a QoS policy, what happens if you exceed the 'Rate Limit' set for a traffic class?

Accepted Answer

The excess traffic is policed. Traffic exceeding the rate limit is policed (dropped or shaped).

Answer

The traffic is redirected to another interface

Answer

The traffic is logged as critical

Answer

The connection is reset

Question 5

Which TWO of the following are required for FTD transparent mode deployment?

Accepted Answer

BVI with an IP address.. In FTD transparent mode, the firewall acts as a Layer 2 bridge, so you must configure a Bridge Virtual Interface (BVI) with an IP address (option D) to provide a management and routing endpoint for the bridged traffic, and you must assign the physical interfaces to bridge groups (option E) so they forward traffic between segments without IP addressing. These two elements are the defining requirements of transparent mode: the bridge group binds the interfaces together at Layer 2, and the BVI supplies the single Layer 3 address used for management and for any traffic terminating on the firewall. Public IP addresses on all interfaces (option A) are not required because transparent-mode data interfaces do not carry IP addresses, only the BVI does. A static routing protocol (option B) is unnecessary since transparent mode does not route between interfaces. VLAN tagging on all ports (option C) is optional and only needed when trunking multiple VLANs through the bridge group, not as a baseline requirement.

Answer

Public IP addresses on all interfaces.

Answer

Static routing protocol.

Answer

VLAN tagging on all ports.

Question 6

An organization mandates that all integration traffic between Cisco Firepower Management Center and Cisco SecureX must be inspected. Which cloud connection mechanism does FMC use to communicate with SecureX threat intelligence and telemetry?

Accepted Answer

Outbound HTTPS REST API communication to Cisco SecureX cloud endpoints.. FMC connects outbound to Cisco SecureX using HTTPS (TCP port 443) via public cloud APIs and messaging fabric.

Answer

Direct syslog forwarding over TCP 6514 to the SecureX collector.

Answer

Inbound SSH tunneling initiated by the SecureX cloud connector.

Answer

Bidirectional IPSec VPN tunnel established automatically between FMC and SecureX cloud cluster.

Question 7

When troubleshooting policy deployment failures, which log file on the FMC should be examined to see the specific error returned by the device during the commit process?

Accepted Answer

Deployment History. The Deployment History in FMC records each policy deployment attempt, including the specific error messages returned by the managed device during the commit process. It is the primary place to troubleshoot deployment failures.

Answer

FMC kernel log

Answer

Snort logs

Answer

System Access Log

Answer

Audit logs

Question 8

An administrator is setting up a high availability pair of Cisco Secure Firewall devices. During the HA configuration wizard in FMC, the administrator is asked to provide a registration key. What is the purpose of this key?

Accepted Answer

It provides mutual authentication and establishes the secure trust relationship between the primary and secondary units.. The registration key (shared secret) is used to securely authenticate and encrypt the initial communication channel between the primary and secondary units during the HA pairing process.

Answer

It authorizes the FMC to push the initial bootstrap image to the standby unit.

Answer

It decrypts encrypted payloads passing across the stateful data links.

Answer

It unlocks the advanced clustering license on both firewalls.

Question 9

An FTD device managed by FMC is failing to download latest Snort Rule Updates (SRUs) and GeoDB updates automatically. The FMC has internet access via an HTTPS proxy. Where must the HTTPS proxy settings be configured on the FMC so that it can successfully reach Cisco update servers?

Accepted Answer

System > Configuration > Proxy. For the FMC to download SRUs and GeoDB updates through an HTTPS proxy, the proxy settings must be configured under System > Configuration > Proxy. This is the global proxy configuration that the FMC uses for all outbound internet communications, including update downloads.

Answer

Objects > Object Management > Network Proxy

Answer

Devices > Device Management > Advanced > Proxy

Answer

Policies > Access Control > Updates > Proxy

Question 10

An FMC administrator is troubleshooting a scenario where device registration between an FTD and FMC fails immediately with a registration key mismatch error. The administrator verified the NAT ID and registration key. What underlying protocol handshake fails during this registration process, and how can it be debugged?

Accepted Answer

The sftunnel (TCP 8305) handshake fails; debug using 'sftunnel status' and examining /var/log/sftunnel.log.. FTD-to-FMC registration relies on the sftunnel, which uses TCP 8305 for its handshake and ongoing management communication. When registration fails with a key mismatch, the sftunnel handshake is what is failing, and it can be debugged with 'sftunnel status' and by examining /var/log/sftunnel.log on the FTD.

Answer

The HTTPS REST API (TCP 443) handshake fails; debug using 'debug rest-api'.

Answer

The SNMP trap receiver fails; debug using 'system support snmp-debug'.

Answer

The SSH tunnel (TCP 22) fails; debug using 'tail -f /var/log/secure'.

Question 11

An engineer wants to group several FTD interfaces into a single logical zone to simplify Access Control rule creation. Where are security zones created in the FMC?

Accepted Answer

Objects > Object Management > Security Zones. Security zones are created under Objects > Object Management > Security Zones.

Answer

System > Integration > Security Zones

Answer

Policies > Access Control > Zones

Answer

Devices > Device Management > Interfaces > Zones

Question 12

An engineer is troubleshooting a mutual TLS connection failure between Cisco ISE pxGrid and the FMC. The openssl command on the FMC reveals a 'certificate verify failed' error. What is the underlying reason for this error?

Accepted Answer

The peer certificate has been signed by a Certificate Authority whose root certificate is missing from the local trust store.. A 'certificate verify failed' error indicates that the client or server certificate was signed by a CA that is not present in the truststore of the peer verifying it.

Answer

The NTP clock skew between FMC and ISE exceeds 60 seconds, causing token expiration.

Answer

The pxGrid shared secret key contains unsupported special characters.

Answer

TCP port 8910 is blocked by an intermediate stateful firewall.

Question 13

An administrator is designing a logging architecture where Cisco Secure Firewall Threat Defense exports connection and intrusion events to a third-party SIEM. Which TWO design principles should be followed to ensure security and scalability? (Choose two)

Accepted Answer

Implement Reliable Syslog (TCP/TLS) to ensure encrypted transmission and prevent packet loss during network congestion.. Option C is correct because Reliable Syslog using TCP with TLS provides encrypted transport and TCP's acknowledgment/retransmission mechanisms prevent event loss during congestion, which is essential when exporting connection and intrusion events to a third-party SIEM. Option E is correct because applying appropriate severity filters ensures that only relevant events (e.g., higher-severity intrusion and connection events) are forwarded, preventing low-priority debug noise from exhausting SIEM storage capacity and ingestion license limits, which directly supports scalability. Option A is wrong because disabling Access Control rule logging removes valuable connection telemetry, and eStreamer on unencrypted TCP 8302 lacks transport encryption, undermining security. Option B is wrong because relying solely on FMC database storage defeats the purpose of a SIEM architecture and provides no third-party correlation or long-term retention. Option D is wrong because exporting logs unencrypted over UDP 514 across the internet exposes sensitive event data to interception and UDP offers no delivery guarantee, causing packet loss.

Answer

Disable all Access Control rule logging and enable eStreamer over unencrypted TCP port 8302.

Answer

Rely exclusively on FMC database storage without exporting events to any SIEM.

Answer

Configure all logs to be exported unencrypted via UDP port 514 across the internet.

Question 14

When configuring syslog export from Cisco Secure Firewall Threat Defense using Firepower Management Center, which alert format should you choose to ensure standard SIEM ingestion parsers can easily read the event headers?

Accepted Answer

IETF (RFC 5424) format. Syslog messages exported from Secure Firewall Threat Defense can be formatted using BSD (RFC 3164) or IETF (RFC 5424) formats. RFC 5424 is the standard IETF structured format widely supported by modern SIEMs.

Answer

SNMP v2c Trap format

Answer

Legacy ASA native text format

Answer

NetFlow v9 structured records

Question 15

Which THREE configuration settings must be verified on the FMC when troubleshooting syslog export issues to a third-party SIEM receiver? (Choose three)

Accepted Answer

Syslog server IP address and port configuration in Platform Settings. Option A is correct because the syslog server IP address and port must be configured under Platform Settings > Syslog on the FMC; if the destination host or port is wrong or missing, no events will reach the third-party SIEM receiver. Option C is correct because the transport protocol selected on the FMC (UDP, TCP, or TLS) must match what the SIEM collector is listening for and can decode; a mismatch such as sending UDP to a TCP/TLS-only collector silently drops the events. Option E is correct because Access Control rule logging must be enabled with the appropriate log action (log at beginning and/or end of connection) for connection events to be generated and forwarded to syslog; without logging enabled on the relevant rules, there is nothing to export. Option B does not belong because pxGrid client approval in Cisco ISE relates to pxGrid-based identity and context sharing, not to FMC syslog export to a SIEM. Option D does not belong because eStreamer uses its own client certificate and is a separate event-streaming mechanism from syslog export, so its certificate validity is irrelevant to troubleshooting syslog delivery.

Answer

pxGrid client approval status in Cisco ISE

Answer

eStreamer client certificate validity