300-710 SNCF Practice Test 15 — 15 Questions

Question 1

You are deploying a high-availability pair of Firepower Threat Defense (FTD) units. Which TWO requirements must be met to ensure stateful failover functions correctly?

Accepted Answer

Both units must be running the exact same version of FTD software.. Stateful failover requires a dedicated link and matching hardware/software configurations.

Answer

The failover link must be connected to a dedicated management port.

Answer

The standby unit must be configured with a different hostname.

Answer

The failover interface must be configured as a physical interface for redundancy.

Question 2

When utilizing static route tracking, what value represents the frequency of the tracking probe?

Accepted Answer

Frequency interval.. The SLA Monitor configuration allows you to define the frequency (in seconds) at which the probe is sent to the target.

Answer

Threshold value.

Answer

Timeout interval.

Answer

TTL value.

Question 3

When deploying an FTD in a virtual environment, what is the primary role of the 'GigabitEthernet0/0' interface by default?

Accepted Answer

Management interface.. In most virtual FTD deployments, the first interface is typically reserved for the management or diagnostic connectivity.

Answer

Failover link.

Answer

Data transit.

Answer

State link.

Question 4

Which THREE of the following are supported methods for FTD failover mechanism?

Accepted Answer

Stateful failover.. FTD supports stateful failover, redundant interfaces, and clustering for high availability.

Answer

Transparent proxy failover.

Answer

Manual interface switching.

Question 5

You are deploying a Cisco FTD High Availability pair. During the synchronization process, what occurs when the standby unit fails to receive three consecutive heartbeat hellos from the primary?

Accepted Answer

The standby unit transitions to the Active state.. In FTD HA, three consecutive missed hellos trigger a state change, and the standby unit initiates a failover because it assumes the primary has failed.

Answer

The standby unit initiates a full configuration overwrite from the secondary flash.

Answer

The standby unit enters a suspended state to wait for administrative intervention.

Answer

The primary unit is rebooted automatically by the standby unit.

Question 6

Which TWO statements are true regarding NGIPS passive mode deployment?

Accepted Answer

It is transparent to the network traffic path.. Passive mode is for monitoring only and connects to a span/tap port, thus it cannot affect traffic flow.

Answer

It requires an inline bypass switch.

Answer

It can actively reset connections.

Answer

It requires dual-homed physical interfaces.

Question 7

Which TWO of the following are valid requirements for setting up an FTD high availability pair?

Accepted Answer

The units must be the same FTD model.. FTD HA requires both units to be the same model and the same software version to ensure compatibility.

Answer

The units must have the same amount of memory.

Answer

The units must be managed by different FMC instances.

Answer

The units must be in different subnets.

Question 8

An administrator is troubleshooting an issue where an FMC cannot communicate with a managed FTD device. The health monitor shows registration is down. The administrator checks the FTD CLI and verifies the registration key and NAT ID. Which log file on the FTD should the administrator examine to troubleshoot registration and communication daemon errors (such as sftunnel)?

Accepted Answer

/var/log/cisco/sftunnel.log. The sftunnel daemon manages secure communication between FTD and FMC. Its logs are located in /var/log/cisco/sftunnel.log on the FTD filesystem.

Answer

/var/sf/nl/nl_manager.log

Answer

/var/log/messages

Answer

/opt/cisco/wsm/logs/startup.log

Question 9

An enterprise integrates Cisco Secure Firewall with Cisco SecureX. The security team wants to leverage SecureX Threat Intelligence to automatically quarantine endpoints that exhibit malicious behavior. How does the integration coordinate this mitigation action across SecureX, FMC, and ISE?

Accepted Answer

SecureX instructs Cisco ISE via API/pxGrid to apply an Adaptive Network Control (ANC) quarantine policy to the endpoint, while FMC blocks associated traffic flows.. SecureX orchestrates threat response by triggering an API call to ISE (via pxGrid/ANC) to dynamically apply an Adaptive Network Control (ANC) quarantine policy or to FMC to block the IP, isolating the compromised endpoint.

Answer

SecureX directly accesses the FTD data plane via SSH to shut down the physical switchport.

Answer

The FTD continuously polls SecureX and reconfigures its VLAN database using VTP.

Answer

ISE sends a DHCP release packet to the endpoint through the FTD inspection engine.

Question 10

An engineer is troubleshooting a scenario where Security Group Tags (SGTs) are not being enforced by FTD access control rules despite an active pxGrid connection between ISE and FMC. Which TWO potential causes should the engineer investigate? (Choose two)

Accepted Answer

SXP peering or inline TrustSec header propagation is missing along the data path between the endpoint and the FTD interface.. SGT enforcement requires proper SXP/inline propagation across data paths and correct Access Control rule configuration matching the tags.

Answer

The FTD management interface IP address is not registered in Active Directory.

Answer

The FMC eStreamer service is disabled, blocking SGT updates.

Answer

Syslog facility local0 is not configured on the switch.

Question 11

An administrator is setting up Cisco ISE pxGrid integration with Cisco Secure Firewall Management Center. Which TWO configuration steps must be performed on the Cisco ISE side to ensure successful integration? (Choose two)

Accepted Answer

Approve the FMC client registration request in the Cisco ISE pxGrid client management settings.. ISE configuration for pxGrid requires enabling the pxGrid service on the designated ISE node and approving the FMC client registration.

Answer

Configure an eStreamer server instance on the ISE policy service node.

Answer

Enable SNMPv2c traps on the ISE administration node.

Answer

Export the ISE TACACS+ shared secret to the FTD CLI.

Question 12

You are configuring identity-based access control rules on Cisco Secure Firewall Threat Defense using user groups imported from Cisco ISE via pxGrid. Users report that they are not matching the identity rule, although their IP address is correctly mapped to their username in the FMC Active Sessions table. What is the root cause?

Accepted Answer

The Realm configuration on the FMC has failed to synchronize user group DNs from the Active Directory source.. If user-to-IP mapping exists in the Active Sessions table but identity rules fail, it is often because the Realm configuration on the FMC has not successfully synchronized user group memberships from the Active Directory domain controller integrated behind ISE, or the group distinguished names do not match.

Answer

Advanced Malware Protection (AMP) cloud connection is offline.

Answer

SNMP traps are disabled on the Cisco ISE policy service node.

Answer

The eStreamer client certificate is untrusted by the FMC.

Question 13

When deploying a Cisco Secure Firewall Threat Defense virtual appliance (FPRv) in a public cloud environment such as Microsoft Azure, which TWO architectural considerations or limitations must be accounted for? (Choose two)

Accepted Answer

User-Defined Routes (UDRs) in Azure must be configured to point traffic destined for other subnets to the FTDv internal interface IP.. Azure deployments have specific constraints regarding throughput licensing models, interface requirements (Management, Inside, Outside), and lack of native support for certain on-prem features like traditional physical clustering.

Answer

The FTDv management interface can be shared with the data plane traffic if bandwidth optimization is enabled.

Answer

Physical clustering using dedicated control interfaces is natively supported in Azure just like on-prem hardware.

Answer

Dynamic routing protocols (BGP/OSPF) are entirely unsupported on virtual appliances deployed in public clouds.

Question 14

You are deploying an FTD unit in transparent mode. Which requirement must be met for the management interface and data interfaces during the initial configuration?

Accepted Answer

The FTD must be configured with a bridge group, and the management interface must have an IP address for connectivity.. In transparent mode, the FTD acts as a Layer 2 firewall. The management interface must be configured to provide access to the device, but the data interfaces do not require IP addresses for traffic processing, although they must be bridged.

Answer

Transparent mode is only supported when using the FTD inside a virtual port channel (vPC).

Answer

Data interfaces must be configured with an IP address on the same subnet as the management interface.

Answer

The management interface must be on a separate physical switch from the data interfaces.

Question 15

You need to implement static route tracking on an FTD to ensure traffic fails over to a secondary ISP. Which object is used to define the reachability check?

Accepted Answer

SLA Monitor object. SLA Monitor objects are used to track reachability to a target IP, and the static route is then associated with this monitor.

Answer

Route map

Answer

Failover group

Answer

Interface tracking group