300-710 SNCF Practice Test 17 — 15 Questions

Question 1

When configuring an FTD cluster, what is the maximum number of nodes supported in a single cluster?

Accepted Answer

16. The FTD clustering architecture supports up to 16 nodes in a single cluster.

Answer

4

Answer

8

Answer

2

Question 2

Which THREE considerations must be addressed when deploying FTDv in a public cloud?

Accepted Answer

Integration with cloud route tables for failover.. Cloud deployments require API-based routing, specific instance sizing, and VPC-level security group awareness.

Answer

Hardware bypass capabilities.

Answer

Clustering using local control links.

Question 3

You are deploying FTD in a cloud environment. What is the primary purpose of the 'Management Interface' when launching the virtual instance?

Accepted Answer

To communicate with the FMC.. The management interface is used exclusively for the FMC or FDM to configure and manage the FTD appliance. Data traffic is kept separate to maintain security and throughput.

Answer

To provide high availability heartbeats.

Answer

To perform stateful inspection of internal traffic.

Answer

To handle internet-bound traffic.

Question 4

When planning an FTD high availability deployment, which TWO requirements are critical for the link between the two firewalls?

Accepted Answer

The link must have low latency for heartbeat messages.. The failover link must be dedicated, low-latency, and support sufficient bandwidth for the synchronization of the state table.

Answer

The link must be configured with OSPF.

Answer

The link must be on the same subnet as the management interface.

Answer

The link must be at least 1Gbps.

Question 5

An administrator is configuring the Cisco eStreamer client on a Linux-based SIEM collector to connect to the FMC. After copying the generated certificate files to the client, the connection attempt fails with an error indicating that the client certificate is untrusted. What is the most likely reason for this failure?

Accepted Answer

The FMC CA certificate was not installed in the client's trusted certificate store, preventing the client from trusting the FMC's server certificate.. When generating eStreamer certificates on the FMC, the administrator must download the FMC CA certificate and place it in the client's trusted certificate store so the client trusts the FMC's TLS server certificate during the handshake.

Answer

The eStreamer client script was written in Python 3 instead of Python 2.

Answer

The eStreamer service on the FMC must be restarted via expert mode after every certificate generation.

Answer

The FMC management interface IP address changed, invalidating the eStreamer database index.

Question 6

In routed mode, what is the purpose of the 'Name' assigned to an interface?

Accepted Answer

To define the interface for use in security policies and NAT.. The name assigned to an interface (e.g., 'outside') is used in policy rules and NAT definitions to identify the zone or security level.

Answer

To define the failover priority.

Answer

To change the speed of the physical interface.

Answer

To set the MAC address.

Question 7

Which of the following is a limitation when deploying an FTD in transparent mode?

Accepted Answer

It does not support dynamic routing protocols.. Transparent mode does not support dynamic routing protocols (like OSPF or BGP) because it acts as an L2 bridge.

Answer

It does not support NAT.

Answer

It cannot handle VLAN tags.

Answer

It requires manual ARP entries for all hosts.

Question 8

Which TWO of the following are required when configuring a static route with tracking?

Accepted Answer

Track ID association in the static route.. Static route tracking requires an SLA Monitor object to check reachability and a static route that references this monitor.

Answer

Interface tracking group.

Answer

BGP weight.

Answer

OSPF cost value.

Question 9

Which TWO components must be configured to manage an FTD via the FMC?

Accepted Answer

Registration key.. Management requires configuring the management IP on the FTD and registering it with the FMC using a registration key.

Answer

Default gateway on the data interface.

Answer

A valid license on the FMC.

Answer

SNMP community string.

Question 10

You are troubleshooting a port channel failure on an FTD device. The port channel is 'Up/Down'. What is the most likely cause?

Accepted Answer

Mismatched LACP configuration.. An 'Up/Down' status for a port channel usually indicates that LACP negotiation is failing between the FTD and the connected switch.

Answer

Insufficient license.

Answer

The FTD is in transparent mode.

Answer

Physical cable damage.

Question 11

An engineer needs to analyze the connection history and security events from an FTD device that occurred three weeks ago. However, when querying the FMC event viewer, the events are missing. What is the most likely cause of this behavior?

Accepted Answer

The events were overwritten because the event database retention period or disk space limit was reached.. FMC event databases have configurable retention policies and disk space thresholds. If event retention settings are low or disk space fills up, older events are automatically purged to prevent disk exhaustion.

Answer

The administrator must run 'database-cli optimize' on the FTD CLI to unhide historical events.

Answer

The FTD automatically flushes its local event buffer every 48 hours regardless of FMC configuration.

Answer

Security events older than 7 days are automatically archived to the Cisco Cloud Analytics platform by default.

Question 12

An administrator is troubleshooting a syslog integration where Secure Firewall Threat Defense is sending logs to a SIEM, but the receiving SIEM cannot parse the message headers properly because the timestamp format is in local time rather than UTC. Where can the timestamp format for syslog messages be adjusted on the FMC?

Accepted Answer

In Platform Settings > Syslog settings, under the advanced options for syslog message formatting.. Syslog timestamp formats (such as UTC vs local time, and inclusion of year) are configured in the FTD Platform Settings under the Syslog or Time synchronization settings.

Answer

In Objects > Object Management > Syslog Formats.

Answer

In the Access Control Policy advanced logging tab.

Answer

In System > Preferences > Timezone on the FMC.

Question 13

Which command is used on the Cisco Secure Firewall Threat Defense CLI to verify that the device is successfully communicating with the Cisco Secure Firewall Management Center?

Accepted Answer

show managers. To check the registration and management connection status between FTD and FMC, the administrator uses the CLI command 'show managers'.

Answer

show fmc status

Answer

show isc status

Answer

show controller connection

Question 14

An administrator is troubleshooting a Cisco Secure Firewall Threat Defense and Cisco ISE pxGrid integration where user-to-IP mappings are not being received by the FTD. Which TWO troubleshooting steps should the administrator perform on the FTD or FMC CLI to diagnose the issue? (Choose two)

Accepted Answer

Examine the identity daemon logs and run 'show idedb statistics' to check if user identity maps are being processed.. To troubleshoot pxGrid integration issues on Secure Firewall, administrators check the pxGrid client status using specific CLI commands and inspect system/identity logs on the FTD appliance.

Answer

Inspect the 'estreamer.log' file on the FMC to verify pxGrid heartbeat timers.

Answer

Run 'debug radius packet' on the FMC CLI to trace pxGrid TLS packets.

Answer

Execute 'show ise-server session' on the FTD privileged EXEC mode.

Question 15

Which of the following must be identical on both units of an FTD high availability pair to ensure successful synchronization?

Accepted Answer

Software versions.. Both units must have the same model, software version, and license capabilities for the HA configuration to function correctly.

Answer

The management IP addresses.

Answer

The number of configured VLANs.

Answer

Physical serial numbers.