300-710 SNCF Practice Test 18 — 15 Questions

Question 1

An administrator needs to define network objects in the FMC Object Management menu. Which THREE object types are natively supported for network definition? (Choose three)

Accepted Answer

Host Object. FMC supports Host, Range, Network (subnet), FQDN, and Network Group objects for network definitions.

Answer

Port Object

Answer

Application Filter Object

Question 2

During a routine backup of the FMC, the administrator wants to ensure that the generated backup file contains critical historical events, configurations, and intrusion event data so that it can be fully restored to a replacement appliance if necessary. Which backup type should be selected in the FMC?

Accepted Answer

Manual Backup with both System Settings and Historical Event Data checkboxes enabled. In FMC, a Manual Backup allows you to select both 'System Settings' and 'Historical Event Data' checkboxes. Enabling both ensures that the backup includes configurations, intrusion events, and other historical data, which is necessary for a full restore to a replacement appliance. This is the only backup type that captures both system configuration and event data.

Answer

RAID Controller Configuration Export

Answer

System Configuration Backup only

Answer

Snort Rule Update (SRU) Snapshot Backup

Question 3

Which THREE features are critical for maintaining a stable FTD cluster?

Accepted Answer

Synchronized FMC management.. Option B is correct because all members of an FTD cluster must be managed by the same FMC (or FDM in a single-device-manager scenario) so that configuration, policies, and cluster state remain synchronized across the cluster. Option C is correct because the data interfaces of clustered FTDs must be bundled into an EtherChannel (port channel) so that traffic can be load-balanced and redistributed across members while presenting a single logical interface to the network. Option E is correct because a dedicated cluster control link is required for members to exchange heartbeat, state, and control messages; without it, the cluster cannot form or maintain quorum and failover. Option A is not required because cluster members share a single logical IP address per data interface (with individual physical/IPs only on the control link), and Option D is not a cluster requirement since FTD clustering performs its own load distribution without an external load balancer.

Answer

Individual IP addresses for every member on every network.

Answer

External load balancer for traffic scrubbing.

Question 4

An administrator is configuring a secure firewall deployment in an environment where dynamic routing via OSPF is required across multiple security zones. Which configuration requirement must be met on the Cisco Secure Firewall Threat Defense?

Accepted Answer

OSPF must be enabled globally, associated with specific areas, and enabled on the specific routed interfaces belonging to security zones.. To run OSPF on Cisco Secure Firewall Threat Defense, you must enable OSPF globally, define it for specific areas, and then enable it on the individual routed interfaces that belong to security zones. This three-step process ensures that OSPF adjacencies form only on intended interfaces and that routing information is exchanged within the correct security context.

Answer

OSPF neighbor adjacencies must terminate on the firewall management interface.

Answer

OSPF requires all participating interfaces to be assigned to the exact same security zone.

Answer

OSPF can only be enabled on transparent bridge virtual interfaces (BVIs).

Question 5

An administrator configures an eStreamer client script on a remote server to receive events from FMC. The script connects successfully and starts receiving events, but after a few hours, the connection drops and throws a timeout error. What is the most likely cause of this behavior?

Accepted Answer

An intermediate firewall or stateful device closed the TCP port 8302 session due to inactivity timeout.. Firewalls or intermediate network devices along the path between the external eStreamer client and the FMC often have idle session timeouts (e.g., 30 minutes or 1 hour). If eStreamer traffic is quiet, the session times out. eStreamer keepalive configurations or firewall idle timeouts must be adjusted.

Answer

The eStreamer service on the FMC has a hard-coded 2-hour session limit for security reasons.

Answer

The FMC automatically rotates the eStreamer client certificate every 4 hours.

Answer

The Snort inspection engine on the FTD restarts hourly to clear cache.

Question 6

Which TWO FTD interface types are commonly used for connectivity to an ISP?

Accepted Answer

Routed interface.. A routed interface (C) is correct because it is a Layer 3 interface configured with an IP address that can be used as the outside/egress interface toward an ISP, supporting static routes, DHCP client, and NAT. A sub-interface (E) is correct because it is a logical VLAN-tagged interface created on a physical or port-channel interface, commonly used when the ISP provides multiple VLANs or services over a single link (e.g., internet plus MPLS). The cluster control link (A) is wrong because it is a dedicated interface for inter-chassis clustering traffic, not ISP connectivity. A passive interface (B) is wrong because it is an interface where routing protocols are suppressed from sending updates, not a connectivity type to an ISP. A bridge group interface (D) is wrong because it is a Layer 2 bridging construct used to join interfaces into a bridge domain, not a typical ISP-facing Layer 3 interface.

Answer

Cluster control link.

Answer

Passive interface.

Answer

Bridge group interface.

Question 7

An administrator is configuring an inline interface pair on a Cisco Secure Firewall Threat Defense device using Cisco FMC. The business requires that if the firewall experiences a power failure or kernel panic, traffic must continue to flow uninterrupted through the network segment. Which action should the administrator take?

Accepted Answer

Configure the inline set with the 'Fail Open' setting and ensure hardware bypass is supported and enabled on the network module.. Hardware bypass capability (fail-open) on supported Network Interface Modules (NIMs/SMs) allows physical optical or copper paths to bridge automatically when power is lost or the Snort engine crashes.

Answer

Set up a redundant EtherChannel with LACP fast-rate timers.

Answer

Deploy the interfaces in a Bridge Virtual Interface (BVI) group with spanning tree disabled.

Answer

Configure the inline set with the 'Fail Close' setting and enable STP root guard.

Question 8

Which type of FTD interface should be configured to connect to a trunk port on a switch?

Accepted Answer

Sub-interface with a VLAN tag.. A sub-interface, when assigned a specific VLAN ID, is used to process traffic on a trunked link.

Answer

Physical interface without a VLAN ID.

Answer

Management interface.

Answer

Port channel interface.

Question 9

An FMC administrator is configuring a URL Filtering policy. They want to block URLs categorized as 'Hacking' while logging the event. Where is this configured within the Access Control Policy?

Accepted Answer

Policies > Access Control > Access Control Policy > Rules > URLs tab. URL Filtering is enforced as part of Access Control rules in the FMC. Within an ACP rule, the URLs tab lets the administrator select URL categories (such as 'Hacking') and set the action to Block while enabling logging on the rule. This binds the URL category match directly to the rule's action and logging behavior.

Answer

Objects > Object Management > URL Objects

Answer

Policies > SSL Decryption > URL Match criteria

Answer

Devices > Device Management > URL Filtering Settings

Question 10

Which THREE components of an Access Control rule can be used to identify traffic as 'Application' based?

Accepted Answer

Application Category. In an Access Control rule, traffic can be identified as Application-based by matching on the Application Name (D), which targets a specific application signature such as 'facebook' or 'ssh'; by the Application Category (A), which groups applications by function such as 'social-networking' or 'file-sharing'; and by the Application Tag (C), which matches applications sharing a common attribute such as 'evasive' or 'high-risk'. These three are the application-identification criteria available in the rule's Application column, since App-ID classifies traffic by name, category, and tag. Device Type (B) and OS Version (E) are host/endpoint attributes used for policy matching (for example in HIP or User-ID based rules), not application identifiers, so they cannot be used to identify traffic as Application based.

Answer

Device Type

Answer

OS Version

Question 11

You are configuring a static route on a Cisco Secure Firewall Threat Defense using FDM. Which parameters are strictly required to create a valid IPv4 static route?

Accepted Answer

Destination IP network, subnet mask, and next-hop IP address or egress interface.. A valid static route requires a destination network (prefix/mask), and either a next-hop IP address or an egress outgoing interface.

Answer

MAC address of the next-hop router and security zone name.

Answer

IP SLA tracking object ID and weighted cost metric.

Answer

Source IP address, destination IP address, and BGP Autonomous System number.

Question 12

Which license state must an FTD device reach to allow the FMC to push policy configurations to it?

Accepted Answer

Registered and licensed. An FTD device must be in the 'Registered and licensed' state for the FMC to push policy configurations to it. Registration establishes the management connection, and licensing ensures that the device is entitled to the required features. Only when both conditions are met can policies be deployed.

Answer

Disabled

Answer

Unregistered

Answer

Waiting for registration

Answer

Standby mode only

Question 13

When using clustering with FTD, what is the 'Flow Owner' in the context of traffic distribution?

Accepted Answer

The unit that maintains the connection state for a specific flow.. In FTD clustering, the Flow Owner is the unit that owns and maintains the connection state (session table entry) for a specific flow. All packets of that flow are forwarded to the Flow Owner, which performs stateful inspection and maintains the connection. This ensures stateful failover and consistent policy enforcement across the cluster, since only one unit owns the flow at a time.

Answer

The master unit that manages the configuration.

Answer

Any unit that has the highest CPU availability.

Answer

The unit that performs the SSL decryption for the flow.

Question 14

An administrator wants to create a Port object group containing TCP ports 80, 443, and 8080 on the FMC. Where is this object configured?

Accepted Answer

Objects > Object Management > Ports. Port object groups and individual ports are created under Objects > Object Management > Ports.

Answer

Policies > Access Control > Ports

Answer

Devices > Device Management > Object Explorer

Answer

System > Configuration > Port Groups

Question 15

An administrator is configuring Cisco Secure Firewall Threat Defense to send syslog messages. Which TWO options can be included in the syslog message header or content to assist SIEM correlation and analysis? (Choose two)

Accepted Answer

Device name or firewall identifier in the syslog header. Option A is correct because the syslog header generated by Cisco Secure Firewall Threat Defense includes the device name or firewall identifier (the configured hostname), which lets a SIEM attribute each event to a specific sensor and correlate events across multiple firewalls. Option D is correct because Platform Settings on the FMC allow you to configure the syslog timestamp format (e.g., UTC or local time) and message severity, and a precise, consistent timestamp is essential for ordering and correlating events in a SIEM. Option B is not valid because exporting an FMC administrator password hash has no correlation value and would be a serious security exposure. Option C is not valid because syslog messages are lightweight event records and cannot carry a full Active Directory database file. Option E is not valid because syslog is a text-based protocol and does not append raw PCAP binary dumps to every message; packet capture is handled separately.

Answer

FMC administrator password hash for auditing

Answer

Full Active Directory database file attachments

Answer

Raw PCAP binary dumps appended to every syslog packet