300-710 SNCF Practice Test 16 — 15 Questions

Question 1

An administrator is configuring a new Cisco Secure Firewall Threat Defense in routed mode on Firepower Device Manager (FDM). During the initial setup, the administrator needs to define the routing behavior for a multi-zone deployment. Which configuration step is mandatory when setting up routed mode?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign a unique Layer 3 IP address to each data interface and associate it with a security zone.. When configuring a routed mode interface on FDM, each data interface must be assigned a unique Layer 3 IP address and associated with a security zone. This is mandatory because routed mode requires interfaces to act as Layer 3 gateways, and security zones are used to apply policies. Without an IP address and zone, the interface cannot route or be managed.

Answer

Disable the Snort inspection engine on all interfaces to allow bridging.

Answer

Assign a unique MAC address override to every physical interface.

Answer

Create a BVI (Bridge Virtual Interface) for each pair of physical interfaces.

Question 2

Which interface configuration mode allows the FTD to handle traffic across multiple physical links as a single logical interface?

Accepted Answer

Port Channel. A Port Channel (EtherChannel) aggregates multiple physical interfaces into a single logical interface, providing increased bandwidth, load balancing, and link redundancy. On Cisco Secure Firewall Threat Defense, port channels are configured in routed or transparent mode and use LACP or static mode to bundle links. This is the only interface mode listed that combines multiple physical links into one logical interface for traffic handling.

Answer

Redundant Interface

Answer

Bridge Group

Answer

Sub-interface

Question 3

An administrator is troubleshooting asymmetric routing issues across an FTD firewall using the FMC connection events and FTD CLI. The administrator wants to disable TCP state bypass or adjust TCP normalization settings to allow non-synchronized SYN packets through for a specific application. Where are TCP normalization and stateful inspection parameters configured for FTD?

Accepted Answer

Devices > Platform Settings > Edit Policy > Stateful Inspection / TCP Settings. TCP normalization and stateful inspection parameters for FTD are configured under Devices > Platform Settings > Edit Policy > Stateful Inspection / TCP Settings. This is where you adjust TCP state bypass, normalization, and related settings that affect how the FTD handles asymmetric flows and non-synchronized SYN packets.

Answer

Policies > Access Control > Advanced > Network Settings

Answer

Objects > Object Management > Advanced > TCP State

Answer

System > Configuration > Global Parameters > TCP

Question 4

An administrator wants to generate a health report on the FMC to present hardware utilization trends over the past 30 days. Which section of the FMC GUI provides pre-built health reports and metric tracking?

Accepted Answer

Analysis > Health > Monitor. The FMC's Analysis > Health > Monitor section provides pre-built health dashboards and metric tracking for managed devices, including CPU, memory, disk, and interface statistics over configurable time ranges such as the past 30 days. This is where administrators generate health reports and view historical utilization trends.

Answer

Policies > Actions > Health Reporting

Answer

Devices > Device Management > Health Status

Answer

System > Monitoring > Syslog

Question 5

An administrator is configuring port channels (EtherChannels) on Cisco Secure Firewall Threat Defense interfaces. Which TWO requirements or guidelines must be followed? (Choose two)

Accepted Answer

LACP (Link Aggregation Control Protocol) can be used to dynamically negotiate and manage the port channel.. Port channels require matching channel-group configurations, identical speed/duplex/mode on member ports, and support LACP.

Answer

Port channel interfaces cannot be assigned to security zones.

Answer

Port channels are restricted to passive NGIPS monitoring interfaces only.

Answer

Active/Standby HA pairs must have completely different port channel ID numbers on the standby unit.

Question 6

When registering a new Cisco Secure Firewall Threat Defense device to Cisco Defense Orchestrator (CDO) or Cisco FMC, what is the primary prerequisite protocol or connectivity requirement that must be established from the managed device toward the management platform?

Accepted Answer

Outbound TCP connection on port 8305 from the FTD to the manager's IP address or registration FQDN.. Managed devices initiate outbound secure communication (typically over TCP port 8305 / sftunnel) to the management platform (FMC or CDO).

Answer

An active SNMPv3 trap receiver configured on the manager pointing to the FTD.

Answer

Inbound SSH access from the management platform IP address to the firewall management interface.

Answer

An IPSec site-to-site VPN tunnel terminating on the data interfaces.

Question 7

An administrator wants to configure Access Control rules on Cisco Secure Firewall Threat Defense using identity context received from Cisco ISE via pxGrid. Which TWO criteria can be utilized in the Access Control policy rule configuration once pxGrid is fully integrated? (Choose two)

Accepted Answer

User names and User Groups. Option A is correct because once Cisco ISE is integrated with Cisco Secure Firewall Threat Defense via pxGrid, the firewall receives user identity mappings (user-to-IP and user-to-group) that can be referenced directly in Access Control policy rules as User and User Group conditions. Option B is correct because pxGrid also propagates Security Group Tags (SGTs) from ISE, and the Access Control policy can match traffic based on source/destination SGT values (TrustSec/SGT conditions) when the integration is fully established. Options C, D, and E are incorrect because DHCP lease pool exhaustion percentages, OSPF neighbor adjacency states, and MACsec encryption key lifetimes are not identity context delivered by pxGrid and are not selectable criteria in Access Control rule configuration; they relate to DHCP monitoring, routing protocol state, and link-layer encryption key management, respectively.

Answer

DHCP lease pool exhaustion percentages

Answer

OSPF neighbor adjacency states

Answer

MACsec encryption key lifetimes

Question 8

An enterprise is deploying Cisco Secure Firewall Threat Defense virtual appliances on-premises using VMware ESXi. Which THREE prerequisites or hypervisor configurations are required for proper operation? (Choose three)

Accepted Answer

Allocate sufficient vCPU, RAM, and disk storage in accordance with Cisco FTDv sizing guidelines for the targeted throughput.. VMware ESXi deployments require correct vSwitch/vDS port group configurations (promiscuous mode where needed, or specific VLAN policies), appropriate vCPU/RAM allocation according to sizing guides, and correct dedicated vNIC mapping.

Answer

Configure the ESXi management kernel port to run Cisco ASA clustering over a WAN circuit.

Answer

Install physical line cards directly into the ESXi server motherboard PCIe slots for FTDv interface expansion.

Question 9

Which THREE criteria can be used to match traffic in an Access Control Policy rule?

Accepted Answer

Application. Access control rules can match based on Source/Destination Network, Applications, and URL categories.

Answer

SSL Certificate Name

Answer

QoS Priority

Question 10

An administrator is configuring interface-level QoS on an FTD device. Which THREE parameters or features can be configured within an FTD QoS policy? (Choose three)

Accepted Answer

DSCP Marking. Qos policies on FTD support rate limiting, traffic shaping, priority queuing, and marking DSCP values.

Answer

Active Directory user group mapping

Answer

Automatic IP address translation (NAT mapping)

Question 11

An administrator is configuring manual NAT on an FTD device managed by FMC. Which TWO parameters must be defined when creating a manual NAT rule? (Choose two)

Accepted Answer

Original Source. Manual NAT rules require defining the NAT type (Static or Dynamic) and the Original Source (along with other matching parameters like interfaces or destination).

Answer

Prefilter FastPath action

Answer

Security Intelligence Whitelist

Answer

Snort Inspection Engine Mode

Question 12

What is the consequence of configuring an FTD interface with 'Non-Promiscuous' mode in a virtualized deployment?

Accepted Answer

The FTD may fail to inspect traffic that is not destined for its interface MAC address.. In virtualized environments (like ESXi), 'Promiscuous mode' is often required on the vSwitch to allow the FTD to see traffic not destined for its own MAC address, which is essential for transparent or passive modes.

Answer

The FTD performance will increase.

Answer

The FTD will only process broadcast traffic.

Answer

It forces the FTD into routed mode.

Question 13

When deploying an FTD virtual appliance on-prem using VMware ESXi, which virtual network adapter type is recommended for optimal performance?

Accepted Answer

VMXNET3. VMXNET3 is the recommended virtual network adapter type for Cisco Secure Firewall Threat Defense virtual appliances on VMware ESXi because it is a paravirtualized adapter designed for high performance, offering better throughput and lower CPU utilization than emulated adapters. It supports advanced features like multi-queue, checksum offload, and large receive offload, which are critical for a firewall processing high packet rates. Cisco documentation explicitly recommends VMXNET3 for FTDv deployments.

Answer

E1000

Answer

E1000E

Answer

SR-IOV

Question 14

An administrator configures Cisco Secure Firewall Threat Defense to integrate with Cisco ISE via pxGrid. Which TWO operational benefits are provided by this integration for firewall policy enforcement? (Choose two)

Accepted Answer

Consumption of Security Group Tags (SGTs) for tag-based microsegmentation and access filtering.. The pxGrid integration between Cisco Secure Firewall Threat Defense (FTD) and Cisco ISE enables the firewall to subscribe to ISE's identity and context data, so option E is correct: FTD can enforce Access Control policies using user identity, username, and user group membership learned via pxGrid (identity-based firewall rules). Option D is also correct because pxGrid can deliver Security Group Tags (SGTs) from ISE, allowing FTD to perform tag-based microsegmentation and access filtering using SGT values in its rules. Option A is not provided by pxGrid integration; IDS/IPS signatures are delivered through Cisco Talos signature updates, not ISE. Option B is incorrect because pxGrid does not stream raw PCAP files to SIEMs; it shares contextual session/identity data, and PCAP export is a separate FTD/FMC capability. Option C is incorrect because FMC administrator password management is not an ISE pxGrid function; ISE integration is about identity and group context, not managing FMC admin credentials.

Answer

Automatic generation of FTD intrusion detection signatures.

Answer

Real-time streaming of raw PCAP files to third-party SIEM platforms.

Answer

Direct management of FMC appliance administrator passwords.

Question 15

An organization uses Cisco Secure Firewall Threat Defense and integrates with Cisco ISE for identity policies. The security team notices that identity rules are intermittently failing because the FTD cache of IP-to-user mappings is being flushed unexpectedly. Upon investigation, what condition on FTD or ISE typically causes the purging of active user identity maps?

Accepted Answer

Receipt of an accounting stop message from the authenticator or an explicit session termination event from ISE pxGrid.. User identity mappings on FTD can be purged or invalidated due to RADIUS accounting stop messages, explicit pxGrid session termination notices from ISE (such as logoff or re-authentication timeouts), or when the maximum session idle timer expires on the firewall identity policy configuration.

Answer

A mismatch in the NTP time synchronization greater than 5 minutes between the FTD and the FMC.

Answer

Exceeding the FMC database storage limit for event logging.

Answer

Automatic daily rotation of the FMC administrator password.