300-710 SNCF Practice Test 15 — 15 Questions

Question 1

When analyzing performance issues, which THREE metrics should an administrator monitor in the FMC Health Monitor?

Accepted Answer

CPU utilization. In the FMC Health Monitor, CPU utilization (A) is a core metric because sustained high processor load directly degrades policy deployment, event processing, and GUI responsiveness. Memory utilization (B) must be monitored since FMC runs multiple services (e.g., the database, Tomcat, and eventing processes) that can exhaust RAM and trigger swapping or service restarts. Disk utilization (C) is equally critical because the FMC stores event data, configuration backups, and updates on disk; a full /var or / volume can halt logging and even the web interface. The unmarked options do not belong because user login frequency (D) and the number of active GUI sessions (E) are administrative activity indicators, not system health or performance metrics tracked by the FMC Health Monitor.

Answer

User login frequency

Answer

Number of active GUI sessions

Question 2

You need to map internal users to specific security policies based on their AD group membership. What must be configured in FMC to support this?

Accepted Answer

Identity Policy. Identity policies require an Identity Realm and agent integration to map user IPs to group memberships.

Answer

Access Control Policy

Answer

Network Discovery Policy

Answer

SSL Decryption Policy

Question 3

An enterprise is deploying a Cisco Secure Firewall Threat Defense cluster. During the setup of the Cluster Control Link (CCL), the administrator must ensure specific networking criteria are met. What is a primary design requirement for the CCL interface?

Accepted Answer

It must be a dedicated, high-bandwidth, low-latency Layer 2 link between cluster nodes.. The Cluster Control Link requires low latency, high bandwidth, and a dedicated non-routable Layer 2 connection (or directly connected point-to-point links) between cluster members.

Answer

It must share the same physical interface as the external data interfaces using 802.1Q subinterfaces.

Answer

It must be routed across a public Layer 3 MPLS cloud with dynamic BGP peering.

Answer

It must be configured with NAT overload enabled to translate inter-node control packets.

Question 4

An enterprise security architect is designing an architecture where Cisco Secure Firewall Threat Defense integrates with a third-party SIEM. Which THREE methods or protocols are officially supported for exporting security events and logs from the FMC/Firewall to the third-party SIEM? (Choose three)

Accepted Answer

Cisco SecureX / REST APIs for programmatic event retrieval. Option B is correct because the FMC exposes documented REST APIs (and Cisco SecureX/Threat Response integrations) that allow programmatic retrieval of events, alerts, and metadata for third-party SIEM consumption. Option C is correct because syslog forwarding is configured under Platform Settings on the FMC/Firewall, supporting UDP, TCP, and TLS transports to send connection, intrusion, and audit events to external collectors. Option E is correct because eStreamer is Cisco's officially supported event-streaming API that lets custom clients receive real-time event data from the FMC for SIEM integration. Option A is not supported: direct SQL replication against the FMC's internal PostgreSQL database is neither documented nor permitted, and would break support. Option D is not supported: SNMPv1 traps are used for health/status alerting, not for forwarding full packet payloads or complete security event logs.

Answer

Direct SQL database replication from the FMC internal PostgreSQL database to the SIEM

Answer

SNMPv1 trap forwarding of full packet payloads

Question 5

You are configuring SSL decryption. To ensure that traffic to a specific financial domain is NOT decrypted due to privacy regulations, what must you configure in the SSL Decryption Policy?

Accepted Answer

Configure an SSL rule with the 'Do Not Decrypt' action. In Palo Alto Networks SSL decryption policy, the 'Do Not Decrypt' action is specifically designed to bypass decryption for traffic that must remain encrypted for legal, privacy, or compliance reasons. When a financial domain is matched by an SSL rule with this action, the firewall forwards the session without performing any SSL forward proxy or inbound inspection, preserving end-to-end encryption. This satisfies privacy regulations while still allowing the firewall to log the connection metadata.

Answer

Use a 'Monitor' action in the SSL policy

Answer

Create an Access Control Rule with a 'Decrypt' action

Answer

Add the domain to the Prefilter Policy

Question 6

When configuring manual NAT on an FTD device, which THREE options are available for configuring the Translated Source? (Choose three)

Accepted Answer

Specific IP Address or Network Object. In FTD manual NAT, the Translated Source field offers three choices: A 'Specific IP Address or Network Object' lets you statically translate the source to a single host or subnet object; D 'Dynamic IP Address Pool' translates to an address drawn from a configured pool (dynamic NAT); and E 'Interface (Dynamic PAT)' translates to the selected interface's IP using PAT/overload. These correspond to the standard static, dynamic, and PAT source translation methods available in the NAT policy. The unmarked options do not belong: B 'Prefilter FastPath target' relates to prefilter policy actions, not NAT translation, and C 'Security Intelligence blacklist feed' is a Security Intelligence feature for blocking traffic, not a source translation type.

Answer

Prefilter FastPath target

Answer

Security Intelligence blacklist feed

Question 7

An administrator wants to check the status of all software processes running on an FMC appliance (such as the web server, database, and event handlers) to ensure everything is running smoothly. Which command should be run in the FMC CLI?

Accepted Answer

pmtool status. The 'pmtool status' command in the FMC CLI displays the status of all software processes managed by the Process Manager, including the web server, database, and event handlers. It is the correct command to verify that all FMC services are running properly.

Answer

firepower-status -v

Answer

systemctl status all

Answer

show process manager

Question 8

When defining a NAT rule for an internal server, what happens if the 'DNS Rewrite' option is enabled?

Accepted Answer

The FTD modifies DNS responses. DNS Rewrite modifies the payload of DNS responses to ensure clients reach the correct internal server IP instead of the NAT public IP.

Answer

The FTD forces a DNS query to an external server

Answer

The FTD creates a new NAT object

Answer

The FTD blocks all DNS traffic

Question 9

Which component is mandatory for managing multiple FTD devices in a distributed enterprise deployment?

Accepted Answer

Firepower Management Center (FMC). Firepower Management Center (FMC) is the centralized management platform required to manage and orchestrate policies across multiple FTD appliances.

Answer

Cisco Secure Workload

Answer

Cisco DNA Center

Answer

Firepower Device Manager (FDM)

Question 10

An administrator is setting up a new Cisco Firepower Threat Defense device and needs to configure platform-level parameters using FMC Platform Settings. Which TWO features can be configured via Platform Settings? (Choose two)

Accepted Answer

SNMP parameters. Options C and E are correct because FMC Platform Settings is specifically designed for platform-level (device-level) configuration rather than traffic inspection policies. SNMP parameters (option C) such as SNMPv2c/v3 community strings, users, hosts, and traps are configured under Platform Settings > SNMP, allowing the FTD to be monitored by an SNMP manager. Syslog Server configuration (option E) is also configured under Platform Settings > Syslog, where you define syslog servers, severity levels, and logging facilities for sending events off-box. Option A is incorrect because SSL decryption certificate assignment is configured within the SSL policy (part of the access control policy configuration), not Platform Settings. Option B is incorrect because NAT is configured as part of the FTD NAT policy, which is a separate policy in FMC. Option D is incorrect because Access Control Policy rules are configured in the ACP itself, not in Platform Settings.

Answer

SSL Decryption Certificate assignment

Answer

Network Address Translation (NAT)

Answer

Access Control Policy rules

Question 11

How do you enable 'High Availability' (HA) for an FTD pair managed by FMC?

Accepted Answer

Under Devices > Device Management. HA is configured in the Device Management section by selecting two devices to pair.

Answer

Under Policies > HA

Answer

Via the System > Configuration menu

Answer

In the Access Control Policy

Question 12

An administrator is configuring Security Intelligence on the FMC to drop traffic from known malicious IP addresses. Where in the Access Control Policy is Security Intelligence evaluated relative to standard access rules?

Accepted Answer

Before Access Control rules are evaluated. Security Intelligence is evaluated before access control rules in the FMC access control policy. This allows the system to quickly drop traffic from known malicious IP addresses, URLs, or DNS names without having to process the full access control rule set. This pre-evaluation improves performance and security by blocking threats early.

Answer

Inside the Prefilter policy configuration menu

Answer

After all Access Control rules are evaluated as a fallback action

Answer

Concurrently with Intrusion Policy inspection

Question 13

You are configuring a NAT rule and need to hide the internal network behind a single interface IP. Which NAT translation setting is required?

Accepted Answer

Interface PAT. Interface PAT (Port Address Translation) overloads the interface's own IP address and uses unique source ports to distinguish sessions, allowing many internal hosts to share a single public IP. This is the standard hide-NAT configuration on FTD when you want to mask the internal network behind one interface address.

Answer

Static IP

Answer

Dynamic IP

Answer

Identity NAT

Question 14

An engineer deploys an NGIPS in passive mode using a SPAN (Switched Port Analyzer) port on a core switch. During traffic analysis, the engineer notices that the firewall is not seeing TCP reset packets generated by internal servers. What is the primary operational limitation of deploying an NGIPS in passive mode that explains this behavior?

Accepted Answer

Passive sensors operate out-of-band and cannot block traffic inline or guarantee packet delivery state synchronization.. A passive NGIPS deployed via SPAN receives a copy of traffic out-of-band, so it is not in the forwarding path and cannot guarantee that it sees every packet, including TCP resets generated by internal servers. Because it does not participate in the TCP session, it also cannot enforce inline blocking or maintain perfect state synchronization, which explains why reset packets may be missing from its view.

Answer

Passive mode forces the Snort engine to disable all custom intrusion rules.

Answer

Passive sensors cannot inspect encrypted TLS traffic due to missing cryptographic keys.

Answer

SPAN ports automatically drop TCP reset flags for security reasons.

Question 15

When integrating Cisco Secure Firewall with Cisco SecureX, which component acts as the local orchestrator and liaison that relays threat intelligence and response actions between the managed FTD devices and the SecureX cloud?

Accepted Answer

Cisco Secure Firewall Management Center (FMC). The Cisco Secure Firewall Management Center (FMC) acts as the central management point and cloud connector for SecureX integrations across all managed FTD sensors.

Answer

The Snort inspection engine running on each FTD

Answer

The Cisco Defense Orchestrator (CDO) local proxy

Answer

Cisco Identity Services Engine (ISE)