300-710 SNCF Practice Test 14 — 15 Questions

Question 1

Which THREE types of events can be streamed natively from Cisco Secure Firewall using the eStreamer API to a third-party SIEM or custom application? (Choose three)

Accepted Answer

Connection events. The eStreamer API is Cisco Secure Firewall's native event-streaming interface that pushes specific event categories to external SIEMs or custom applications. Option A (Connection events) is correct because connection/flow records are one of the core event types eStreamer exports, providing session details such as source/destination IP, ports, and bytes. Option C (File events) is correct because file and malware events generated by file policy (including file disposition and trajectory data) are streamed via eStreamer. Option E (Intrusion events) is correct because IPS/intrusion events from Snort-based inspection are a primary eStreamer event class. Option B is not correct because hardware temperature sensor telemetry is not an eStreamer event type; it is health monitoring data surfaced in FMC, not streamed through eStreamer. Option D is not correct because CLI administrator command audit logs are not part of the eStreamer event stream; administrative audit records are handled through FMC audit logging rather than eStreamer.

Answer

FMC hardware temperature sensor telemetry logs

Answer

CLI administrator command audit logs

Question 2

An administrator is configuring SSL Decryption to inspect internal clients browsing external websites. The organization wants to ensure that traffic to financial and health-related websites is bypassed to maintain privacy and regulatory compliance. How should this be configured in the SSL Policy?

Accepted Answer

Create a rule matching the Financial/Health URL categories with the action 'Do Not Decrypt'.. Privacy and regulatory compliance for financial and health traffic is achieved by creating an SSL policy rule that matches the Financial and Health URL categories and sets the action to 'Do Not Decrypt'. This bypasses decryption for those flows while still allowing the rest of the SSL policy to decrypt other traffic. The rule should be placed above any broader Decrypt rules so it matches first.

Answer

Use an Intrusion Policy rule to drop packets destined for financial URLs.

Answer

Add financial servers to an SSL Decryption Known Key list.

Answer

Configure a Prefilter policy to fast-path financial URL categories.

Question 3

An administrator is performing a backup and restore operation on an FMC appliance. Which THREE statements are correct regarding the FMC restore process? (Choose three)

Accepted Answer

Restoring a backup overwrites the existing configuration and database on the target FMC.. Option B is correct because the FMC restore process is destructive: it replaces the existing configuration and database on the target appliance with the contents of the backup, so any current settings are overwritten. Option D is correct because the backup includes the FMC's internal CA and certificate material; when restored to a different appliance, the CA keys and identity differ from what managed FTD devices originally trusted, so the devices may need to be re-registered or have trust re-established. Option E is correct because FMC backups are version-specific and can only be restored onto an FMC running the exact same software version as the one that generated the backup. Option A is incorrect because restoring across major version differences (e.g., v6.2 backup onto v7.4) is not supported; you must first restore to the matching version and then upgrade. Option C is incorrect because an FMC backup captures the FMC configuration and database, not the local flash images on managed FTD devices, so those images are not restored by an FMC restore.

Answer

Backups can be restored across major software version differences (e.g., restoring a v6.2 backup directly onto v7.4).

Answer

Restoring an FMC backup automatically restores all connected FTD local flash images.

Question 4

An engineer is troubleshooting a scenario where an FTD device fails its pre-upgrade health check during an upgrade initiated from the FMC. Which THREE common pre-check failures must be resolved before proceeding? (Choose three)

Accepted Answer

Unapplied pending configuration deployments between FMC and FTD.. Option B is correct because the FMC pre-upgrade health check verifies configuration synchronization, and any pending, undeployed policy or configuration changes between FMC and the managed FTD must be deployed before the upgrade can proceed. Option C is correct because the upgrade process requires adequate free space on the target partition (such as /var or /CiscoMFT) to stage and extract the new software image, and the pre-check fails if disk space is insufficient. Option D is correct because active critical health monitor alarms indicate an unhealthy device state, and the pre-check blocks the upgrade until those critical alarms are cleared. Option A is not a pre-check failure condition, since active SSH sessions to the FTD CLI do not by themselves block an FMC-initiated upgrade. Option E is not a failure condition either, as static routes and default gateways are normal, valid configuration and are not checked as an upgrade blocker.

Answer

Active SSH sessions logged into the FTD CLI.

Answer

Configured static routing tables with default gateways.

Question 5

An administrator configures Cisco Secure Firewall Threat Defense to send syslog messages to a remote SIEM. Which TWO features help ensure that syslog messages are transmitted securely and reliably across untrusted networks? (Choose two)

Accepted Answer

Enabling TLS encryption for syslog transmission to protect sensitive log contents in transit.. Option B is correct because enabling TLS encryption for syslog transmission (often implemented as syslog over TLS, typically on TCP port 6514) protects the confidentiality and integrity of log contents as they traverse untrusted networks, preventing eavesdropping or tampering. Option C is correct because Reliable Syslog over TCP uses TCP's acknowledgments, retransmissions, and flow control to ensure messages are delivered reliably, unlike fire-and-forget UDP syslog. Option A is incorrect because SNMPv3 privacy and authentication secure SNMP polling/traps, not syslog transport, and configuring it on the syslog server does not secure syslog messages. Option D is incorrect because designating the syslog server IP as a secondary management gateway is not a valid or relevant mechanism for securing or ensuring reliable syslog delivery. Option E is incorrect because SSH tunneling does not run over UDP port 514, and standard syslog over UDP 514 is neither encrypted nor reliable.

Answer

Configuring SNMPv3 privacy and authentication parameters on the syslog server.

Answer

Configuring the syslog server IP as a secondary management gateway.

Answer

Enabling SSH tunneling on UDP port 514.

Question 6

What is the effect of changing the order of rules in an Access Control Policy?

Accepted Answer

Changes the evaluation sequence. Rules are evaluated top-down; changing the order can cause a rule to be shadowed or never matched.

Answer

No effect

Answer

Resets the device

Answer

Updates the device firmware

Question 7

An administrator integrates Cisco Secure Firewall Management Center with Cisco SecureX. Which TWO benefits and features are unlocked by this cloud integration? (Choose two)

Accepted Answer

Cross-product pivoting and investigation capabilities from security events to network flows.. Option C is correct because integrating FMC with Cisco SecureX enables cross-product pivoting and investigation: security events seen in FMC can be enriched and pivoted into related network flows and telemetry from other Cisco security products through SecureX threat response, accelerating investigation and response. Option E is correct because the integration synchronizes threat intelligence (for example, from Cisco Talos and other sources) into FMC and enables automated blocking of malicious indicators such as IPs, domains, and file hashes across managed FTD sensors via access control and intrusion policies. Option A is incorrect because SecureX does not replace the FMC's on-box PostgreSQL database with a cloud-hosted data warehouse; FMC retains its local configuration and event database. Option B is incorrect because SecureX does not perform direct hardware provisioning or zero-touch booting of physical FTD appliances; those tasks rely on mechanisms like FTD zero-touch provisioning with a cloud-delivered manager or on-premises FMC. Option D is incorrect because SecureX does not automatically generate TACACS+ administrator credentials for FTD CLI access; TACACS+ authentication is configured separately on FMC/FTD and the TACACS+ server.

Answer

Replacement of the FMC PostgreSQL database with a cloud-hosted data warehouse.

Answer

Direct hardware provisioning and zero-touch booting of physical FTD appliances via SecureX.

Answer

Automatic generation of TACACS+ administrator credentials for FTD CLI access.

Question 8

In an FTD high availability pair, what happens to the standby unit if it loses the heartbeat signal on the failover link?

Accepted Answer

It promotes itself to Active.. If the standby unit loses heartbeat signals from the active unit, it assumes the active unit has failed and initiates a failover transition to become the new active unit.

Answer

It reboots.

Answer

It remains standby.

Answer

It enters a 'Failed' state.

Question 9

Which TWO statements are true regarding NGIPS passive mode deployment?

Accepted Answer

It is transparent to the network traffic path.. In a passive NGIPS deployment, the sensor is not placed directly in the traffic path; instead it receives a copy of the traffic, so option B is correct because the device is transparent to the network and cannot affect forwarding. Option C is correct because that copy is delivered by connecting the sensor to a SPAN (mirror) port on a switch or to a network TAP, which replicates packets for monitoring. Option A is incorrect because an inline bypass switch is used for inline (fail-to-wire) deployments, not passive ones. Option D is incorrect because resetting connections requires the sensor to be inline or to send TCP resets via an inline-capable interface, which is not the passive monitoring model. Option E is incorrect because dual-homed physical interfaces are associated with inline or routed deployments, whereas passive mode typically uses a single monitoring interface.

Answer

It requires an inline bypass switch.

Answer

It can actively reset connections.

Answer

It requires dual-homed physical interfaces.

Question 10

What is the purpose of an 'FQDN' object in FMC?

Accepted Answer

To define a domain name. FQDN objects are used to define network resources by domain name, which the FTD resolves.

Answer

To define a protocol port

Answer

To define a zone

Answer

To define a static IP

Question 11

Which THREE factors affect the choice between deploying FTD in Routed vs Transparent mode?

Accepted Answer

Layer 2 vs Layer 3 placement.. Option A is correct because the fundamental decision between FTD Routed and Transparent mode hinges on whether the firewall is inserted as a Layer 3 hop (routed, with IP addresses on its interfaces) or as a Layer 2 bridge (transparent, forwarding traffic without modifying the IP topology). Option B is correct because Transparent mode is specifically designed for scenarios where existing IP addressing and subnets cannot be renumbered or changed, since it acts as a "bump in the wire" and preserves the current Layer 3 scheme. Option E is correct because Routed mode is required to perform NAT and to participate in dynamic routing protocols (such as OSPF, EIGRP, or BGP), whereas Transparent mode does not support NAT or dynamic routing and only forwards frames based on Layer 2 information. Option C is incorrect because the brand of the upstream switch is irrelevant — FTD interoperability does not depend on switch vendor. Option D is incorrect because the number of users is a sizing/scalability consideration, not a factor that determines Routed versus Transparent mode selection.

Answer

The brand of the upstream switch.

Answer

The number of users.

Question 12

An engineer has deployed an active/standby High Availability pair of Cisco Secure Firewall Threat Defense devices. A failure occurs on the active unit, and a failover successfully takes place. However, upon recovery of the original active unit, it immediately resumes its role as the active unit, causing a brief secondary interruption. Which failover setting governs this behavior?

Accepted Answer

Failover Preempt Configuration. Failover Preempt Configuration controls whether a recovered higher-priority unit automatically reclaims the active role. When preempt is enabled, the recovered unit immediately takes back active status, causing the brief secondary interruption described. When preempt is disabled (the default in many deployments), the recovered unit stays in standby and the current active unit retains the role, avoiding the extra failover.

Answer

MAC Address Persistence Timer

Answer

HEMS Poll Frequency

Answer

Stateful Failover Sync Interval

Question 13

If you need to block a specific file type (e.g., .exe) from being downloaded, which feature must you enable in the Access Control Rule?

Accepted Answer

File Policy. File policies are associated with Access Control rules to inspect and block files.

Answer

SSL Policy

Answer

IPS Policy

Answer

QoS Policy

Question 14

An FTD device is configured in routed mode. What must be configured to allow traffic to exit the network through the firewall?

Accepted Answer

A static route pointing to the gateway.. In routed mode, the FTD acts as a router; therefore, an upstream default route or specific static routes are required to forward traffic to the next hop.

Answer

An inline bypass pair.

Answer

A bridge group interface.

Answer

A passive monitoring interface.

Question 15

Which FTD deployment mode must be selected to use the device as a transparent bump-in-the-wire for security inspection?

Accepted Answer

Transparent. Transparent mode allows the FTD to be inserted into a network without changing the IP scheme, acting as a bridge.

Answer

Hybrid

Answer

Passive

Answer

Routed